Cdnjs: Should we add X-Content-Type-Options header?

[zackbloom]

The X-Content-Type-Options: nosniff header allows a server or CDN to instruct clients not to try to guess at the Content-Type of a file. This is valuable as a file could have the .js file extension, but look like html which would cause the browser to serve it as a site and grant it access to cookies and the like.

We would very much like to add this header, but what we don't want to do is break any existing libraries or sites which happen to be relying on this behavior. We would love to get the communities thought's on how safe adding it will be.

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[olafcm]

I like this, I think it is save to add since jsDelivr and unpkg have it already set 👍

Regarding to the header config, is it possible to extend the caching for CDNJS?
I think both the "origin" request header and the query string can be ignored, so that would require a custom cache key.

From:
${header:origin}::${scheme}://${host_header}${uri}
To:
${scheme}://${host_header}${uri_iqs}

[ScottHelme]

Dropping by to show some support! 😎

[xtuc]

X-Content-Type-Options: nosniff was added to all files.