Insecure or unset HTTP headers - X-Content-Type-Options - Elixir

Need

To prevent MIME sniffing attacks

Context

1. Usage of Elixir for building scalable and fault-tolerant applications
2. Usage of Plug Cowboy for building web applications in Elixir
3. Usage of HTTP headers management

Description

Insecure Code Example

defmodule Vulnerable do
  use Plug.Router

  plug :match
  plug :dispatch

  get "" do
    conn
    |> put_resp_content_type("text/html")
    |> send_resp(200, "OK")
  end

  match _ do
    send_resp(conn, 404, "Not found")
  end
end

In this Elixir code snippet, the server response doesn't include the X-Content-Type-Options header, making the application vulnerable to MIME sniffing attacks.

Steps

1. Set the X-Content-Type-Options header in the server responses.
2. Set this header to nosniff to disable MIME type sniffing.

Secure Code Example

defmodule Secure do
  use Plug.Router

  plug :match
  plug :dispatch

  get "" do
    conn
    |> put_resp_content_type("text/html")
    |> put_resp_header("x-content-type-options", "nosniff")
    |> send_resp(200, "OK")
  end

  match _ do
    send_resp(conn, 404, "Not found")
  end
end

In this Elixir code snippet, the server response includes the X-Content-Type-Options header with a value of nosniff, preventing MIME type sniffing by the browser.

References

Last updated

2023/09/18