Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
The method \Drupal\Core\EventSubscriber\FinishResponseSubscriber::onRespond contains a comment:
// Prevent browsers from sniffing a response and picking a MIME type
// different from the declared content-type, since that can lead to
// XSS and other vulnerabilities.
// https://www.owasp.org/index.php/List_of_useful_HTTP_headers
$response->headers->set('X-Content-Type-Options', 'nosniff', FALSE);
$response->headers->set('X-Frame-Options', 'SAMEORIGIN', FALSE);
The link https://www.owasp.org/index.php/List_of_useful_HTTP_headers is no more valid, it's respond with HTTP 404.
Proposed resolution
I don't see any replacement for that URL directly, but we can replace this link with the new ones. One per header:
- https://owasp.org/www-project-secure-headers/#x-content-type-options
- https://owasp.org/www-project-secure-headers/#x-frame-options
Or simply without anchor, because it won't choose appropriate tabs with the descriptions anyway.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | interdiff_3-5.txt | 920 bytes | immaculatexavier |
| #5 | 3307227-5.patch | 844 bytes | immaculatexavier |
| #3 | 3307227-3.patch | 1018 bytes | immaculatexavier |
Comments
Comment #2
immaculatexavier commentedComment #3
immaculatexavier commentedAttache patch in accordance to the proposed resolution
Comment #4
niklanThe problem is that anchors are more preferable here, but they don't switch tab to «Response Headers» (“bug” on OWASP site) which contains these anchors and contents itself. So they are useless.
In that case, I think it's better to just use https://owasp.org/www-project-secure-headers and that's it.
Comment #5
immaculatexavier commented@Niklan , Addressed #4
Comment #7
andypostComment #8
cilefen commentedComment #9
smustgrave commentedThis issue is being reviewed by the kind folks in Slack, #need-reveiw-queue. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge require as a guide.
Simple change and can confirm the current link throws a 404.
Comment #10
alexpottBackported to 9.5.x since this is documentation fix.
Committed and pushed 23a41f09cd to 10.1.x and f1aab64ab7 to 10.0.x and 0a3baad943 to 9.5.x. Thanks!