fix (backend): set X-Content-Type-Options to nosniff on the drive files endpoint

2024-04-01 03:21:41 +09:00 · 2024-04-01 03:21:41 +09:00 · 88ca0e1621
parent 9086ef11ff
commit 88ca0e1621
1 changed files with 2 additions and 0 deletions
--- a/packages/backend/src/server/file/send-drive-file.ts
+++ b/packages/backend/src/server/file/send-drive-file.ts
@ -54,6 +54,8 @@ export default async function (ctx: Koa.Context) {
 		return;
 	}

+	ctx.set("X-Content-Type-Options", "nosniff");
+
 	const isThumbnail = file.thumbnailAccessKey === key;
 	const isWebpublic = file.webpublicAccessKey === key;