Skip to content

Commit

Permalink
Chore: Remove inaccurate server configs
Browse files Browse the repository at this point in the history
Temporary remove the server configs examples for the
`x-content-type-options` rule until we better figure
out things.

- - - - - - - - - - - - - - - - - - - - - - - - - - -

Ref #767
  • Loading branch information
alrra committed Jan 30, 2018
1 parent a2f201e commit dfbceca
Showing 1 changed file with 0 additions and 65 deletions.
65 changes: 0 additions & 65 deletions docs/user-guide/rules/x-content-type-options.md
Original file line number Diff line number Diff line change
Expand Up @@ -79,71 +79,6 @@ Content-Type: text/javascript; charset=utf-8
X-Content-Type-Options: nosniff
```

## How to configure the server to pass this rule

<!-- markdownlint-disable MD033 -->
<details><summary>How to configure Apache</summary>

Presuming the script files use the `.js` or `.mjs` extension, and
the stylesheets `.css`, Apache can be configured to serve the with
the `X-Content-Type-Options` header with the value of `nosniff`
using the [`Header` directive][header directive]:

```apache
<IfModule mod_headers.c>
<FilesMatch "\.(css|m?js)$">
Header set X-Content-Type-Options "nosniff"
</FilesMatch>
</IfModule>
```

Note that:

* The above snippet works with Apache `v2.2.0+`, but you need to have
[`mod_headers`][mod_headers] [enabled][how to enable apache modules]
in order for it to take effect.

* If you have access to the [main Apache configuration file][main
apache conf file] (usually called `httpd.conf`), you should add
the logic in, for example, a [`<Directory>`][apache directory]
section in that file. This is usually the recommended way as
[using `.htaccess` files slows down][htaccess is slow] Apache!

If you don't have access to the main configuration file (quite
common with hosting services), just add the snippets in a `.htaccess`
file in the root of the web site/app.

</details>
<details><summary>How to configure IIS</summary>

Presuming the script files are sent with the `Content-Type` header set
to `text/javascript` and styleshees to `text/css` you can use
a [`URL rewrite` rule][url rewrite] like the following:

```xml
<configuration>
<system.webServer>
<rewrite>
<outboundRules>
<!-- Add X-Content-Type-Options header to text/javascript
and text/css responses -->
<rule name="X-Content-Type-Options" enabled="true">
<match serverVariable="RESPONSE_X_Content_Type_Options" pattern=".*" />
<conditions>
<add input="{RESPONSE_Content_Type}" pattern="text\/(javascript|css)" />
</conditions>
<action type="Rewrite" value="nosniff"/>
</rule>
</outboundRules>
</rewrite>
</system.webServer>
</configuration>
```

</details>

<!-- markdownlint-enable MD033 -->

## Further Reading

* [`X-Content-Type-Options` header](https://fetch.spec.whatwg.org/#x-content-type-options-header)
Expand Down

0 comments on commit dfbceca

Please sign in to comment.