question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

X-Content-Type-Options: nosniff header prevents WebViews from loading assets

See original GitHub issue

Do you want to request a feature or report a bug?

Report a bug.

What is the current behavior?

Metro sets the X-Content-Type-Options: nosniff header which causes WebViews to refuse to execute assets loaded from the packager.

If the current behavior is a bug, please provide the steps to reproduce and a minimal repository on GitHub that we can yarn install and yarn test.

Repository can be found here.

Run the app and inspect the WebView content using Safari developer options:

image

What is the expected behavior?

Assets loaded from the packager shouldn’t always set the nosniff header. There may have been reasons for adding this but I believe it should be made configurable for loading assets in development mode. Alternatively we should have a means to set Content-Type for assets.

Please provide your exact Metro configuration and mention your Metro, node, yarn/npm version and operating system.

No extra metro configuration.

RN 58.6 yarn 1.13.0 node 11.10.0 macOS 10.14.3

Upgrading from RN 57.4 to 58.6 introduced this issue.

Headers running 57.4: image

Headers running 58.6: image

Issue Analytics

  • State:open
  • Created 5 years ago
  • Reactions:6
  • Comments:7

github_iconTop GitHub Comments

1reaction
willnix86commented, Nov 2, 2021

Any update here?

0reactions
prem30488commented, Apr 24, 2020

Hi I am having the same issue of nosniff, please provide solution.

Read more comments on GitHub >

github_iconTop Results From Across the Web

X-Content-Type-Options - HTTP - MDN Web Docs - Mozilla
The header allows you to avoid MIME type sniffing by saying that the MIME types are deliberately configured. This header was introduced by ......
Read more >
X-Content-Type-Options HTTP Header - KeyCDN Support
A response is sent back with the header X-Content-Type-Options: nosniff . This prevents the client from "sniffing" the asset to try and ...
Read more >
OWASP Secure Headers Project
X-Content-Type -Options​​ Setting this header will prevent the browser from interpreting files as a different MIME type to what is specified in the...
Read more >
When should I use HTTP header "X-Content-Type-Options
css files, and that it might actually be a bad thing to set the header for other MIME types: Note: nosniff only applies...
Read more >
Strict MIME type checking prevents JavaScript served as 'text ...
GitHub does in fact serve assets from `raw.github.org` with a `X-Content-Type-Options: nosniff` header. Chrome matches the behavior of IE8, 9, ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found