From 26b926293b6115136b06461058b16e106f81a12d Mon Sep 17 00:00:00 2001 From: Catherine Date: Fri, 24 Oct 2025 09:28:47 +0000 Subject: [PATCH] Serve `X-Content-Type-Options: nosniff`. Mozilla HTTP Observatory cares about this (5 points), and there isn't really any reason not to send it at all times. --- src/pages.go | 1 + 1 file changed, 1 insertion(+) diff --git a/src/pages.go b/src/pages.go index a511fc3..633dbc9 100644 --- a/src/pages.go +++ b/src/pages.go @@ -277,6 +277,7 @@ func getPage(w http.ResponseWriter, r *http.Request) error { io.Copy(w, reader) } } else { + w.Header().Set("X-Content-Type-Options", "nosniff") if entry.ContentType != nil { // don't let http.ServeContent mime-sniff compressed data w.Header().Set("Content-Type", *entry.ContentType)