search

eggjs / egg-security

Security plugin for egg, force performance too.
MIT License
238 stars 43 forks source link

fix: disable nosniff on redirect status #38

Closed fengmk2 closed 6 years ago

fengmk2 commented 6 years ago

from 300 ~ 308 see https://github.com/jshttp/statuses/blob/master/index.js#L30

codecov[bot] commented 6 years ago

Codecov Report

Merging #38 into master will increase coverage by 0.01%. The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master      #38      +/-   ##
==========================================
+ Coverage   95.81%   95.83%   +0.01%     
==========================================
  Files          30       30              
  Lines         478      480       +2     
==========================================
+ Hits          458      460       +2     
  Misses         20       20
Impacted Files Coverage Δ
lib/middlewares/nosniff.js 100% <100%> (ø) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update bef87dc...ff4a022. Read the comment docs.

dead-horse commented 6 years ago

nosniff 导致 redirect 失败的链接有么？

fengmk2 commented 6 years ago

@dead-horse 嗯，拦截了 redirect 的跳转

fengmk2 commented 6 years ago

https://tracert.alipay.com/iframe.js

fengmk2 commented 6 years ago

2.2.3

XadillaX commented 6 years ago

@fengmk2 是否要 backport 到 1.x？

fengmk2 commented 6 years ago

@XadillaX https://github.com/eggjs/egg-security/pull/39