2

I have this code in my initialization file.

header("Content-Security-Policy: default-src 'none'; script-src 'self';
        connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline';");
header("X-XSS-Protection: 1; mode=block");
header('X-Content-Type-Options: nosniff');

This code works but my problem is, it is only working in the document (localhost), in the .css and .png files are not working.

Here are the screenshots:

Document (localhost)

enter image description here

.css file

enter image description here

.png file

enter image description here

How can I make header response to the .css and .png files? dareboost gave me this note:

Disable the auto detection of resource type

Protect yourself from malicious exploitation via MIME sniffing.

MIME-Type sniffing explained

Internet Explorer and Chrome browsers have a feature called "MIME-Type sniffing" that automatically detects a web resource's type. This means, for example, that a resource identified as an image can be read as a script if its content is a script.

This property allows a malicious person to send a file to your website to inject malicious code. We advise you to disable the MIME-Type sniffing to limit such activity.

How to prevent MIME-Type sniffing

Configure a "X-Content-Type-Options" HTTP header. Add the "X-Content-Type-Options" HTTP header in the responses of each resource, associated to the "nosniff" value. It allows you to guard against such misinterpretations of your resources.

On this page, you should configure the following resources, that risk being misinterpreted:

http://www.example.com/path/style.css
http://www.example.com/path/logo.png
http://www.example.com/path/icon.png

How do I do this?

0

You can set these HTTP response headers in your server config (or .htaccess file). For example, to apply the X-Content-Type-Options HTTP response header only to .css and .png files, try the following:

<FilesMatch "\.(css|png)$">
    Header set X-Content-Type-Options nosniff
</FilesMatch>
|improve this answer|||||
  • Is there a way to do this in PHP? and the code is giving me an internal server error 500. – Dumb Question Feb 2 '17 at 23:40
  • Now the .css file is working but .png file is not. – Dumb Question Feb 2 '17 at 23:56
  • It is working now. – Dumb Question Feb 3 '17 at 0:20
  • Regarding the "error 500" - sorry, I missed the slash on the closing </FilesMatch> (I guess you must have fixed that). If it wasn't working, but now it is - you may have had a local caching issue. And no, you can't do this with PHP (or rather, you really really shouldn't... you would need to write a PHP script through which you passed all your static resources... a lot more work and hopelessly inefficient for something like this.) – MrWhite Feb 3 '17 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.