Duplicate header X-Content-Type-Options in response

Problem/Motivation

The response header contains the X-Content-Type-Options header twice. Which can scramble security scanning tools.

For example, I recently saw tweets about headers and security https://twitter.com/Stargayte/status/1260654141421961216.

And I have tested https://observatory.mozilla.org/ on my personal website. And among the results, there is:

X-Content-Type-Options header cannot be recognized

The header is present but twice with the same value.

I think one comes from the .htaccess: https://git.drupalcode.org/project/drupal/-/blob/9.0.x/core/assets/scaff...

And the other one from an EventSubscriber: https://git.drupalcode.org/project/drupal/-/blob/9.0.x/core/lib/Drupal/C...

I don't doubt that the effect of the header is correctly applied. But I think it can reassure people testing their website with such tools.

And yes, I also agree that it can easily be fixed with server configuration. But the goal of the issue is to fix out-of-the-box behavior.

Proposed resolution

Remove the directive in .htaccess because the one in the event subscriber can also apply to other webservers than Apache.

Remaining tasks

• Agree on the solution
• Make a patch
• Make a change record?

User interface changes

None

API changes

None

Data model changes

None

Release notes snippet

None