Set X-Content-Type-Options: nosniff

This prevents browsers from guessing the Content-Type, and since we're
always making sure to serve with the known-correct content type, we
don't need the browser to guess.

Change-Id: I02550d6763969f999ec22ec41e5539f945ea7ca4

1 files changed, 4 insertions, 0 deletions

diff --git a/src/media/mod.rs b/src/media/mod.rs
index 199f05f..6f263b6 100644
--- a/src/media/mod.rs
+++ b/src/media/mod.rs
@@ -103,6 +103,10 @@ pub(crate) async fn serve<S: MediaStore>(
                             .unwrap_or("application/octet-stream")
                     ).unwrap()
                 );
+                headers.insert(
+                    axum::http::header::X_CONTENT_TYPE_OPTIONS,
+                    axum::http::HeaderValue::from_static("nosniff")
+                );
                 if let Some(length) = metadata.length {
                     headers.typed_insert(ContentLength(length.get().try_into().unwrap()));
                 }