By poker10 on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
7.x
Introduced in version: 
7.101
Issue links: 
https://www.drupal.org/node/3116482
Description: 

The Apache X-Content-Type-Options header is a security hardening that prevents browsers from interpreting file uploads named (e.g.) index.php.txt from being executed as PHP.

The root .htaccess file now unsets the X-Content-Type-Options header before setting it again.

The reason is that this header is also set in drupal_deliver_html_page(), which depending on Apache configuration might get placed in the onsuccess table. To prevent header duplication, we unset that one prior to setting in the always table.

Site owners should update their .htaccess files with this change to avoid duplicated headers. For example:

  Header onsuccess unset X-Content-Type-Options
  Header always set X-Content-Type-Options nosniff
Impacts: 
Site builders, administrators, editors