openvibers/openvibe.live Commits

img-proxy: send X-Content-Type-Options: nosniff

OP OpenVibers committed 21 Sept 2026 · e31e3422db · 1 file, +1 −0

Defense in depth alongside the existing image/* content-type allowlist and svg exclusion.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01CMxJm1dB8rdsaMSgNjVa82

Changes

ddiff --git a/server/media/external-image-proxy.js b/server/media/external-image-proxy.js
iindex af7e53e0..c27301c8 100644
---- a/server/media/external-image-proxy.js
++++ b/server/media/external-image-proxy.js
@@@ -53,6 +53,7 @@ router.get('/', async (req, res) => {
      res.setHeader('Content-Type', type);
      res.setHeader('Cache-Control', 'public, max-age=86400, immutable');
      res.setHeader('Content-Disposition', 'inline');
++    res.setHeader('X-Content-Type-Options', 'nosniff');
      // No Referer/identifying headers are forwarded to the client here — nothing about the
      // original fetch (redirect chain, upstream headers) leaks past content-type.
      res.end(r.body);