From f41b7872f4f639a79abdf52e066a770fb928019f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=C5=BE=20Jerman?= Date: Thu, 14 Jul 2022 13:52:14 +0200 Subject: [PATCH] Add content-type header for generated config.js --- pkg/webapp/serve.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkg/webapp/serve.go b/pkg/webapp/serve.go index 64056c486..846215b98 100644 --- a/pkg/webapp/serve.go +++ b/pkg/webapp/serve.go @@ -123,6 +123,11 @@ func serveIndex(opt options.HttpServerOpt, indexHTML []byte, serve http.Handler) func serveConfig(r chi.Router, config webappConfig) { r.Get(options.CleanBase(config.appUrl, "config.js"), func(w http.ResponseWriter, r *http.Request) { + + // Assure the content-type + // The presence of the X-Content-Type-Options: nosniff header breaks web applications + w.Header().Add("Content-Type", "text/javascript") + const line = "window.%s = '%s';\n" _, _ = fmt.Fprintf(w, line, "CortezaAPI", config.apiBaseUrl) _, _ = fmt.Fprintf(w, line, "CortezaAuth", config.authBaseUrl)