You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shindig.apache.org by "Adam Winer (JIRA)" <ji...@apache.org> on 2009/04/17 20:32:14 UTC
[jira] Created: (SHINDIG-1019) Proxied requests do not force a
content-type on the response
Proxied requests do not force a content-type on the response
------------------------------------------------------------
Key: SHINDIG-1019
URL: https://issues.apache.org/jira/browse/SHINDIG-1019
Project: Shindig
Issue Type: Improvement
Components: Java
Reporter: Adam Winer
The Gadgets proxy handler does not force a content type for responses that don't contain one from the server. But HTTP responses without Content-Type headers expose a variety of content sniffing attacks.
A reasonable default is application/octet-stream.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (SHINDIG-1019) Proxied requests do not force a
content-type on the response
Posted by "Paul Lindner (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1019?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Paul Lindner resolved SHINDIG-1019.
-----------------------------------
Resolution: Fixed
Fix Version/s: 1.1-BETA4
fixed!
> Proxied requests do not force a content-type on the response
> ------------------------------------------------------------
>
> Key: SHINDIG-1019
> URL: https://issues.apache.org/jira/browse/SHINDIG-1019
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Reporter: Adam Winer
> Fix For: 1.1-BETA4
>
>
> The Gadgets proxy handler does not force a content type for responses that don't contain one from the server. But HTTP responses without Content-Type headers expose a variety of content sniffing attacks.
> A reasonable default is application/octet-stream.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.