search

keystonejs / keystone

The superpowered headless CMS for Node.js — built with GraphQL and React
https://keystonejs.com
MIT License
9.18k stars 1.15k forks source link

Keystone Admin UI serves incorrect MimeType #2741

Closed MadeByMike closed 4 years ago

MadeByMike commented 4 years ago

Bug report

Describe the bug

Currently, bundles returned for the Admin UI (eg. [/admin/js/main.b84baf6b30d5f4898129.bundle.js](http://localhost:3000/admin/js/main.b84baf6b30d5f4898129.bundle.js)) are returned to the browser with a content-type: */* header. This occurs in dev and production modes.

Usually this doesn't cause a problem; I believe this is because browsers have strict MIME type checking disabled by default. If a nginx config on the server specifically turns this checking on:

    # disallow circumventing declared MIME types
    add_header  X-Content-Type-Options nosniff;

It fails to load.

So, the combination of the hardened nginx config and Keystone's sloppy headers causes an error.

It refuses to execute the script because its MIME type ('/') is not executable, and strict MIME type checking is enabled.

pahaz commented 4 years ago

I also have a related problem with svg images MIME type in admin ui.

image

From this doc: https://www.keystonejs.com/guides/custom-field-types/#example

molomby commented 4 years ago

@pahaz, I'm pretty sure this fix (#2864) will resolve your issue too. Would be great if you can update your dependancies and confirm that? It's being shipped right now.