3 ms·
Serve it with content-type set to text/plain and browsers won't try to render it. You can try a random html file on github. If you click raw it'll get rendered
by gruez 9mo ago
Serve it with content-type set to text/plain and browsers won't try to render it. You can try a random html file on github. If you click raw it'll get rendered as text.
- svens_ 9mo agoThis assumption has unfortunately led to countless security issues, at least in the past. The nosniff header (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...), was created because of this and should be added. While this probably works, you should also add a restrictive CSP (using the sandbox directive). Forcing the download (via Content-Disposition header) would likely be even better, but it is annoying for users.
- cxr 9mo agoReplying to this comment because though it's vague in specifics it reads as authoritative and knowledgeable. In reality, it confuses/conflates multiple things. Serving HTML source as text/plain is safe. No browser capable of understanding CSP is going to be at risk of anything that CSP would actually protect against in this case.