Kibana: Canvas "Add element" doesnt work when Kibana is behind NGINX with strict MIME type checking

[ugosan]

Kibana version:
6.5.0
Describe the bug:
When Kibana is behind NGINX reverse proxy and we have strict MIME type checking in place (add_header X-Content-Type-Options nosniff; header) canvas will not display any elements.
Chrome gives an error:

Refused to execute script from '<URL>' because its MIME type ('') is not executable, 
and strict MIME type checking is enabled.

Removing the header makes Canvas work again, I guess making the MIME type explicit would fix it.

Screenshots (if relevant):

Sample NGINX configuration

server {
        listen 443 ssl;
        server_name 0e6395c16cfb11934509421d009b1b1b.elasticdemos.xyz;

        ssl_certificate /etc/letsencrypt/live/elasticdemos.xyz/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/elasticdemos.xyz/privkey.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
        add_header X-Frame-Options DENY;

       # this needs to be commented out in order to make canvas work behind nginx:
       add_header X-Content-Type-Options nosniff;


        ssl_dhparam /etc/ssl/certs/dhparam.pem;

        location  / {
                proxy_pass http://127.0.0.1:5601;
                proxy_http_version 1.1;
                proxy_buffering off;
                proxy_read_timeout 600;
                proxy_send_timeout 600;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $host:$server_port;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forward-Proto https;
                proxy_set_header X-Nginx-Proxy true;

                proxy_redirect off;
        }
}

[elasticmachine]

Pinging @elastic/kibana-canvas

[w33ble]

@ugosan this strikes me as more of a system configuration issue than a Canvas one...

[ugosan]

Not really. The rest of Kibana works just fine with strict MIME types enabled, Canvas is not behaving like the rest of Kibana in this sense.

[DanielLuu]

@ugosan Did you find a workaround?

[sejbot]

Any update on this? Would be great to keep strict MIME types enabled

[stacey-gammon]

@ppisljar - can you look into this and see if it will be an issue for flipping the expression toggle on? Sounds like it might cause a regression.