diff --git a/changelogs/unreleased/dcouture-master-patch-54390.yml b/changelogs/unreleased/dcouture-master-patch-54390.yml new file mode 100644 index 0000000000000000000000000000000000000000..a8d188385f90f4eef8b562783876972994f3a7e4_Y2hhbmdlbG9ncy91bnJlbGVhc2VkL2Rjb3V0dXJlLW1hc3Rlci1wYXRjaC01NDM5MC55bWw= --- /dev/null +++ b/changelogs/unreleased/dcouture-master-patch-54390.yml @@ -0,0 +1,5 @@ +--- +title: Add HTTP header to prevent content sniffing in /assets/* directory +merge_request: +author: +type: security diff --git a/files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb b/files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb index 9e64c811174c70b67ec4fe74f71754b629f50edf_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvbmdpbngtZ2l0bGFiLWh0dHAuY29uZi5lcmI=..a8d188385f90f4eef8b562783876972994f3a7e4_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvbmdpbngtZ2l0bGFiLWh0dHAuY29uZi5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/nginx-gitlab-http.conf.erb @@ -193,6 +193,7 @@ } location <%= File.join(@path, 'assets') %> { + add_header X-Content-Type-Options nosniff; proxy_cache <%= @proxy_cache %>; proxy_pass http://gitlab-workhorse; }