How can I add "X-Content-Type-Options: nosniff" to all the response headers from my web server

Question

I am running an apache web server. I would like to add "X-Content-Type-Options: nosniff" to all the response headers going from my web server. How can I do that? Is it possible to make changes to apache config files to accomplish this?

Solution 1

Just append this to your webserver configuration, after making sure mod_headers is loaded:

<Directory "your_web_server_documents_directory">
    .......
    Header always set X-Content-Type-Options nosniff
    .......
</Directory>

Solution 2

what i did is this. i place the tags right after commented out property modules/mod_headers.so and restart my appserver but still the same response header.

LoadModule headers_module modules/mod_headers.so

<Directory mod_headers.c>
     Header always set X-Content-Type-Options nosniff
</Directory>

Solution 3

open your .htaccess and put this to prevent against XSS, Click-jacking and content-sniffing:

# Extra Security Headers
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options nosniff
</IfModule>

reference: https://htaccessbook.com/increase-security-x-security-headers

Comments

[ssn]

By "making sure mod_headers is loaded", do you mean just making sure "LoadModule headers_module modules/mod_headers.so" is NOT commented out in httpd.conf.