freeipa

#9898 Header X-Content-Type-Options is not set
Closed: fixed by dhanina. Opened by snegrini.

Closed: fixed
Reopen Issue

During a recent OWASP ZAP scan of the FreeIPA WebUI, a low-risk configuration issue was identified.
The application is missing the X-Content-Type-Options: nosniff header. Without this header, some web browsers may perform MIME type sniffing, which can incorrectly interpret file types and potentially lead to Cross-Site Scripting (XSS) vulnerabilities.

CWE: CWE-693: Protection Mechanism Failure

Recommendation
Configure the web server (Apache) to include the X-Content-Type-Options: nosniff header to prevent MIME sniffing.

Metadata Update from @dhanina:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-107899

Metadata Update from @dhanina:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8316

master:

  • ae789eda6f6c659d623186c97bb90c14774d7d3a Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

ipa-4-12:

  • 010b1e3e94e0f9f5a856f3d18a86d271bbdf32ab Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

ipa-4-9:

  • d09ba66a735466a81e38ca83a443a7ce2199d970 Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

ipa-4-13:

  • 7db5506a5e95fc2328d5b4dca65f8a54c0c59f38 Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

ipa-4-8:

  • 909761e03e8826a13c4135b7d14117eaa39dbbc4 Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

ipa-4-10:

  • ecd46192320895b0d3df97e9839d1160649a0e5c Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

ipa-4-11:

  • 16b09c5b5f9510f63be6fa37529824ba9e547e20 Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

ipa-4-6:

  • 1f32da5e587bd92a4fe034b0feb4d58e9f72c1b6 Bump vagrant box version to the latest
  • 0267ef20b1a3c9c2a703b6cb5ad17c03628f8cae Add X-Content-Type-Options header in IdM WebUI. I checked the content type of static files

Metadata Update from @dhanina:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
https://github.com/freeipa/freeipa/pull/8316
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.