Add X-Content-Type-Options header (#540)

Azure · Nov 19, 2018 · df3d4e4 · df3d4e4
1 parent 7fa87d6
commit df3d4e4
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/edge-hub/src/Microsoft.Azure.Devices.Edge.Hub.Service/Startup.cs b/edge-hub/src/Microsoft.Azure.Devices.Edge.Hub.Service/Startup.cs
@@ -78,6 +78,13 @@ public void Configure(IApplicationBuilder app)
 
             app.UseAuthenticationMiddleware(iotHubHostname, edgeDeviceId);
 
+            app.Use(async (context, next) =>
+            {
+                // Response header is added to prevent MIME type sniffing 
+                context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
+                await next();
+            });
+
             app.UseMvc();
         }
     }