Disable MIME-type sniffing on everything we serve

[François Marier]

MIME-type sniffing on IE can lead to unexpected code execution. It can be disabled using an extra header:

  X-Content-Type-Options: nosniff

It should be added to all avatar-serving responses that aren't redirections, but it could also be sent through with other dynamic and static content.

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

[François Marier (fmarier)]

There's a new option for this in Django 1.8:

  https://docs.djangoproject.com/en/1.9/ref/settings/#secure-content-type-nosniff

[François Marier (fmarier)]

It's possible that this option could prevent PNG/JPG/GIF files from being rendered correctly.

This should be tested carefully before enabling it on the mirrors.

[François Marier (fmarier)]

Bug 1252037 needs to be addressed before we can do this.