671612 - Send "X-Content-Type-Options: nosniff" with every response

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, enhancement)

Description

[Max Kanat-Alexander]

It just occurred to me that we should be sending "X-Content-Type-Options: nosniff" along with *every* response, not just with attachments. We specify a valid content-type always, on all our pages, and we never want IE or any browser sniffing.

Comment 1

[Frédéric Buclin]

Why does it matter, outside attachments?

Comment 2

[Max Kanat-Alexander]

(In reply to comment #1)
> Why does it matter, outside attachments?

  Who can say? Maybe some extension will want to use it, maybe we have some pages that might otherwise be sniffed. There are various valid security situations which could come up in the future where this would be useful on all our pages. (I'm happy to describe some of them to you privately if you'd like.)

Comment 3

[Frédéric Buclin]

(In reply to comment #2)
> I'm happy to describe some of them to you privately if you'd like.

Yes, please! :)

Note that I'm not opposed to this proposal (as it's trivial to implement). But I just want to understand what are the security implications you are talking about. I doubt that most websites around the world pass this response, and they are still working fine.

Comment 4

[Max Kanat-Alexander]

(In reply to comment #3)
> (In reply to comment #2)
> > I'm happy to describe some of them to you privately if you'd like.
> 
> Yes, please! :)

  Okay. Grab me on IRC.

> I doubt that most websites around the world pass this
> response, and they are still working fine.

  Actually, quite a few are starting to, now that Safari, IE 8, and IE 9 are becoming more popular. Also, I would say that "most websites around the world" have a poor security posture. :-)

Comment 5

[Matt Selsky [:selsky]]

Attachment: Add header to all responses, v1

Comment 6

[Reed Loden [:reed]]

yep, we should do this... +1 from me.

Comment 7

[Frédéric Buclin]

Comment on attachment 627623 [details] [diff] [review]
Add header to all responses, v1

r=LpSolit

Comment 8

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified attachment.cgi
modified Bugzilla/CGI.pm
modified Bugzilla/Attachment/PatchReader.pm
Committed revision 8249.

Comment 9

[Reed Loden [:reed]]

Requesting approval to land this on 4.2 as well in order to better prevent some IE-specific XSS issues.

Comment 10

[Reed Loden [:reed]]

Committing to: bzr+ssh://bzr.mozilla.org/bugzilla/4.2/
modified attachment.cgi
modified Bugzilla/CGI.pm
modified Bugzilla/Attachment/PatchReader.pm
Committed revision 8136.

Comment 11

[Frédéric Buclin]

Added to relnotes for 4.4 and 4.2.4.