umputun / remark42 / 22268682587

84%

push

github

Add X-Content-Type-Options and Referrer-Policy security headers

Add two missing security headers to the existing securityHeadersMiddleware:

- X-Content-Type-Options: nosniff — prevents browsers from MIME-sniffing
  responses away from the declared Content-Type, stopping e.g. a
  user-uploaded image from being reinterpreted as executable HTML/JS

- Referrer-Policy: strict-origin-when-cross-origin — limits URL information
  leaked in the Referer header on cross-origin requests to just the origin
  (no path), and sends nothing at all on HTTPS-to-HTTP downgrades

2 of 2 new or added lines in 1 file covered. (100.0%)

6109 of 7235 relevant lines covered (84.44%)

34.84 hits per line