From 02e116b69897b08f7c916f6eef44e3dee26759f0 Mon Sep 17 00:00:00 2001 From: Paul Eggleton Date: Fri, 28 Jun 2019 09:33:20 +1200 Subject: [PATCH] docker: disable client MIME type sniffing We should be being explicit about the MIME type rather than allowing the browser to guess. Signed-off-by: Paul Eggleton --- docker/settings.py | 1 + 1 file changed, 1 insertion(+) diff --git a/docker/settings.py b/docker/settings.py index 863fc62..c11c700 100644 --- a/docker/settings.py +++ b/docker/settings.py @@ -298,4 +298,5 @@ USE_X_FORWARDED_HOST = True ALLOWED_HOSTS = [os.getenv('HOSTNAME', 'layers.test')] SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') SECURE_BROWSER_XSS_FILTER = True +SECURE_CONTENT_TYPE_NOSNIFF = True