From c9d188950508f104a8115ec7a78335607d9b6037 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Sat, 3 Oct 2015 15:13:35 -0400
Subject: Issue #462950 by pwolanin, Pere Orga: Mitigate the security risks
 that come from IE, Chrome and other browsers trying to sniff the mime type

---
 includes/bootstrap.inc | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'includes')

diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index efddf006a..b2f2b042e 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -1262,6 +1262,10 @@ function drupal_page_header() {
   $default_headers = array(
     'Expires' => 'Sun, 19 Nov 1978 05:00:00 GMT',
     'Cache-Control' => 'no-cache, must-revalidate, post-check=0, pre-check=0',
+    // Prevent browsers from sniffing a response and picking a MIME type
+    // different from the declared content-type, since that can lead to
+    // XSS and other vulnerabilities.
+    'X-Content-Type-Options' => 'nosniff',
   );
   drupal_send_headers($default_headers);
 }
-- 
cgit v1.2.3