Enable x-content-type-options for CSS and JS files about bootstrapcdn HOT 9 CLOSED

This seems like a reasonable suggestion 👍

from bootstrapcdn.

Does anybody have any objection to adding the header for all filetypes instead for only .css and .js?

from bootstrapcdn.

@XhmikosR I don't check Twitter anymore and so it's wasted bytes over the wire. You dream come true.

from bootstrapcdn.

x-content-type-options: nosniff also enables CORB protection for the resource types:

If the response contains X-Content-Type-Options: nosniff response header, then the response will be CORB-protected if its Content-Type header is one of the following:

HTML MIME type
XML MIME type (except image/svg+xml which is CORB-exempt as described above)
JSON MIME type
text/plain

from bootstrapcdn.

BTW it seems Google sends the header for all files, which arguably would be simpler if we did too...

C:\Users\XhmikosR\Desktop>curl -ILl https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/images/ui-bg_glass_55_fbf9ee_1x400.png
HTTP/2 200
x-content-type-options: nosniff

from bootstrapcdn.

nope

from bootstrapcdn.

@XhmikosR while they are at it, let's remove

x-hello-human: Say hello back! @getBootstrapCDN on Twitter

from bootstrapcdn.

from bootstrapcdn.

@ScottHelme do you know if setting this for all filetypes can be troublesome? I see Google is doing the same and AFAICT browsers should ignore it for filetypes that doesn't apply.

Setting it for all filetypes is simpler, otherwise I could do it for all filetypes it's needed as long as I have a list 🙂

from bootstrapcdn.