You are viewing the documentation for Blueriq 15. Documentation for other versions is available in our documentation directory.
Content sniffing protection
Historically browsers, including Internet Explorer, would try to guess the content type of a request using content sniffing. This allowed browsers to improve the user experience by guessing the content type on resources that had not specified the content type. For example, if a browser encountered a JavaScript file that did not have the content type specified, it would be able to guess the content type and then execute it.
The problem with content sniffing is that this allowed malicious users to use polyglots (i.e. a file that is valid as multiple content types) to execute XSS attacks. For example, some sites may allow users to submit a valid postscript document to a website and view it. A malicious user might create a postscript document that is also a valid JavaScript file and execute a XSS attack with it.
By default this is enabled.
The property should be:
blueriq.security.x-content-type-protection.enabled=true
To disable use:
blueriq.security.x-content-type-protection.enabled=false
Overview
Content Tools