Topic: Puzzled about X-Frame-Options and X-Content-Type-Options

[20160413]

Hi,

I am a bit puzzled about the setting of these two header options:

In the "security.conf" file located in the "conf-available" directory the settings are commented out, i.e.

#Header set X-Content-Type-Options: "nosniff"

and

#Header set X-Frame-Options: "sameorigin"

When I am setting these two in my individual virtual hosts with

<IfModule mod_headers.c>
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
</IfModule>

the setup breaks, i.e an invalid header is send as

DENY, SAMEORIGIN

and

nosniff, nosniff

respectively.

I wonder why this duplication appears by the server appending the second value to my specificly specified value though it is not set anywere in the configuration (at least not that I know of) but in the respective virtual host.

Is there a way to prevent this from happening and to specify these two options in the virtual host that overrides whatever there may be set centrally for the server?

As always may thanks for your help and hints.

PS I am on an Ubuntu 18.04 LTS

[20160413]

Ok, found the cause. MediaWiki is helping me here, aargh

https://github.com/wikimedia/mediawiki/blob/master/includes/WebStart.php#L39

https://github.com/wikimedia/mediawiki/blob/master/includes/installer/WebInstallerOutput.php#L231