I have this code in my initialization file.
header("Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline';"); header("X-XSS-Protection: 1; mode=block"); header('X-Content-Type-Options: nosniff');
This code works but my problem is, it is only working in the document (localhost), in the
.png files are not working.
Here are the screenshots:
How can I make header response to the
dareboost gave me this note:
Disable the auto detection of resource type
Protect yourself from malicious exploitation via MIME sniffing.
MIME-Type sniffing explained
Internet Explorer and Chrome browsers have a feature called "MIME-Type sniffing" that automatically detects a web resource's type. This means, for example, that a resource identified as an image can be read as a script if its content is a script.
This property allows a malicious person to send a file to your website to inject malicious code. We advise you to disable the MIME-Type sniffing to limit such activity.
How to prevent MIME-Type sniffing
Configure a "X-Content-Type-Options" HTTP header. Add the "X-Content-Type-Options" HTTP header in the responses of each resource, associated to the "nosniff" value. It allows you to guard against such misinterpretations of your resources.
On this page, you should configure the following resources, that risk being misinterpreted:
How do I do this?