From 1bdf2b59aa3a1dadef98357782d0da02bd37b4e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=C5=BE=20Jerman?= Date: Thu, 14 Jul 2022 13:52:14 +0200 Subject: [PATCH] Add content-type header for generated config.js --- pkg/webapp/serve.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/webapp/serve.go b/pkg/webapp/serve.go index 24fbf46c0..c820777ab 100644 --- a/pkg/webapp/serve.go +++ b/pkg/webapp/serve.go @@ -97,6 +97,11 @@ func serveIndex(opt options.HttpServerOpt, indexHTML []byte, serve http.Handler) func serveConfig(r chi.Router, appUrl, apiBaseUrl, authBaseUrl, webappBaseUrl, discoveryApiBaseUrl string) { r.Get(options.CleanBase(appUrl, "config.js"), func(w http.ResponseWriter, r *http.Request) { + + // Assure the content-type + // The presence of the X-Content-Type-Options: nosniff header breaks web applications + w.Header().Add("Content-Type", "text/javascript") + const line = "window.%s = '%s';\n" _, _ = fmt.Fprintf(w, line, "CortezaAPI", apiBaseUrl) _, _ = fmt.Fprintf(w, line, "CortezaAuth", authBaseUrl)