Libravatar (obsolete)

  1. Bug #1356347
  2. Comment #0

Comment 0 for bug 1356347

Revision history for this message
François Marier (fmarier) wrote :

MIME-type sniffing on IE can lead to unexpected code execution. It can be disabled using an extra header:

  X-Content-Type-Options: nosniff

It should be added to all avatar-serving responses that aren't redirections, but it could also be sent through with other dynamic and static content.