https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43209 Bug ID: 43209 Summary: Add X-Content-Type-Options security headers Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Koha already sends X-Frame-Options: SAMEORIGIN on its responses but does not send X-Content-Type-Options. Without it a browser may MIME sniff a response and treat it as a content type other than the one declared, which can turn an otherwise harmless response into executable script and enable content type confusion attacks. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.