0

Hi! We are running Mendix with on premise environment. And we have apache httpd server in front of mendix server. When set 'X-Content-Type-Options: nosniff' header in apache httpd configuration, FileDocumentViewer widget cannot display images using Internet Explorer. It seems downloaded image is actually image file. But 'mxui_widget_Image_0: Failed to load image with url https://<url>/file?guid=3096224743819426&changedDate=1519949256514&thumb=true' displayed in IE console. Is there any vulnerability with FileDocumentViewer widget? 'X-Content-Type-Options: nosniff' header is commonly used for prevent XSS.  

asked 2018-03-02

1 answers