3 ms·
> Facebook's CDN still seems to allow serving files with the wrong (unvalidated) content type just by changing the file suffix in the URL. Is this common pract
by update 11y ago
> Facebook's CDN still seems to allow serving files with the wrong (unvalidated) content type just by changing the file suffix in the URL.
Is this common practice amongst websites? seems like a weird config to have enabled.
- grrowl 11y agoIt is weird. I suppose as a result of storing file content by hash only (without extension), then determining the Content-Type header based on the user-supplied extension. Unless they're storing the original filename, they'll have to run through the binary data to determine file type. Crucially though, is they removed the DNS forward to the CDN. Which means they're actually storing .html files on those CDN servers. For ads, presumably, but it seems terribly silly to be storing .html files there at all.