"x-content-type-options: nosniff" only for CSS and JS

Feedback Feature Request Submitting & Feedback
1

Two issues:

  1. x-content-type-options setting mustn’t be under Crypto “HSTS” since isn’t releated
  2. Cloudflare must fallow spec and add “x-content-type-options: nosniff” only to JS and CSS, see
    Fetch Standard and

‘Note: nosniff only applies to “script” and “style” types. Also applying nosniff to images turned out to be incompatible with existing web sites.’

Even when origin server defines x-content-type-options correctly, Cloudflare still will rewrite it (and add a bug) when “No-Sniff Header” enabled in Crypto > HSTS settings.

2

I take the liberty and bump this. IMHO the OP made good points.

3

+1 this was an issue for me too

4

+1 - this is very good point. Please correct this CF

2 Likes