How to add the HTTP X-Content-Type-Options header to a NuGenesis web server - WKB203902

OBJECTIVE or GOAL

Add the "X-Content-Type-Options" HTTP response header to the to websites/applications in Microsoft IIS.

ENVIRONMENT

• Windows Server 2019/2016/2012
• IIS has one or more websites with a valid binding for HTTPS
• NuGenesis 9
• NuGenesis 8

PROCEDURE

1. Open IIS Manager on the web server
2. Connect to the local server
3. Expand the Sites tree, select one of the sites in the list in the Additional Information section
   • This header must NOT be added to the Default Web Site, if the legacy WebVision and Audit Trail Viewer apps are to be used
4. Double-click HTTP Response Codes
5. Click Add.
6. Specify the following for the header name:
   • X-Content-Type-Options
7. Specify the following for the header value:
   • nosniff
8. Click OK
9. Restart the web server

ADDITIONAL INFORMATION

This header should be added to the following sites/applications:

• NuGenesis:
  • SampleShare (v8.0+)
  • SampleShareService (v8.0+)
  • WATERSLMS (v8.0+)
  • AuditTrailClientApp (v9.1+)
  • AuditTrailWebServer (v9.1+)
  • SdmsIdentity (v9.3+)
  • SdmsProjects (v9.3+)
  • SdmsProjectServers (v9.3+)
  • SdmsSdkGateway (v9.3+)
  • SdmsUserPreferences (v9.3+)
  • SdmsVision (v9.3+)

Setting this header on the Default Web Site breaks the legacy SDMS WebVision, legacy Audit Trail, and Help Desk web apps. Setting this header in the HTTP responses instructs compatible web browsers to not "sniff", or guess, the type of data contained in the response. The web browser should adhere to the HTTP Content-Type header.

See article 202467 for guidance on determining whether the header is present in the HTTP replies from the server.

X-Content-Type-Options - HTTP | MDN (mozilla.org)