Commit 20ac30a7 authored by Douwe Maan's avatar Douwe Maan Committed by Michael Kozono

Merge branch '36099-api-responses-missing-x-content-type-options-header' into '10-1-stable'

Include X-Content-Type-Options (XCTO) header into API responses

See merge request gitlab/gitlabhq!2211

(cherry picked from commit 6c818e77f2abeef2dd7b17a269611b018701fa79)

e087e075 Include X-Content-Type-Options (XCTO) header into API responses
parent 89bd7835
...@@ -61,7 +61,10 @@ module API ...@@ -61,7 +61,10 @@ module API
mount ::API::V3::Variables mount ::API::V3::Variables
end end
before { header['X-Frame-Options'] = 'SAMEORIGIN' } before do
header['X-Frame-Options'] = 'SAMEORIGIN'
header['X-Content-Type-Options'] = 'nosniff'
end
# The locale is set to the current user's locale when `current_user` is loaded # The locale is set to the current user's locale when `current_user` is loaded
after { Gitlab::I18n.use_default_locale } after { Gitlab::I18n.use_default_locale }
......
...@@ -50,6 +50,12 @@ describe API::Projects do ...@@ -50,6 +50,12 @@ describe API::Projects do
expect(json_response).to be_an Array expect(json_response).to be_an Array
expect(json_response.map { |p| p['id'] }).to contain_exactly(*projects.map(&:id)) expect(json_response.map { |p| p['id'] }).to contain_exactly(*projects.map(&:id))
end end
it 'returns the proper security headers' do
get api('/projects', current_user), filter
expect(response).to include_security_headers
end
end end
shared_examples_for 'projects response without N + 1 queries' do shared_examples_for 'projects response without N + 1 queries' do
......
RSpec::Matchers.define :include_security_headers do |expected|
match do |actual|
expect(actual.headers).to include('X-Content-Type-Options')
end
end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment