Add directive similar to `X-Content-Type-Options: nosniff`?

w3c / webappsec-csp

WebAppSec Content Security Policy

https://w3c.github.io/webappsec-csp/

Other

210 stars 78 forks source link

Open valtlai opened 6 years ago

valtlai commented 6 years ago

Should CSP have a directive similar to X-Content-Type-Options: nosniff (as it does for X-Frame-Options)? Maybe something like no-type-sniffing.

jonathanKingston commented 6 years ago

Is there any stats on how often mime sniffing happens? I'm guessing it is still pretty common.

martinzhou2015 commented 6 years ago

This idea is good! Issues caused by MIME sniffing still exist. Adding 'no-type-sniffing' enables the developer to cut an extra field in HTTP headers.