Prevent MIME sniffing for tracker JS

Fixes #1247
2024-11-23 20:13:31 +03:00 · 2021-09-23 11:33:42 +02:00 · 2021-09-23 11:33:42 +02:00 · 7af62e2cc4
commit 7af62e2cc4
parent a7eab3f17b
1 changed files with 1 additions and 0 deletions
--- a/lib/plausible_web/plugs/tracker.ex
+++ b/lib/plausible_web/plugs/tracker.ex
@ -64,6 +64,7 @@ defmodule PlausibleWeb.Tracker do

        conn
        |> put_resp_header("content-type", "application/javascript")
+        |> put_resp_header("x-content-type-options", "nosniff")
        |> put_resp_header("cross-origin-resource-policy", "cross-origin")
        |> put_resp_header("access-control-allow-origin", "*")
        |> send_file(200, location)