How to add X-Content-Type-Options Header to my Http Response message when I invoke my function app root url

Question

Hi Team,
As part of my organization security policies, any public access url should have "X-Content-Type-Options " header for http response message. I have function app hosted in azure, when I invoke it's response not includes "X-Content-Type-Options" header in it's response. How I can add this header set globally from my azure function host?

Answer 1

That header is part of the content security policy of a site. You don't want to add it haphazardly without understanding (and using) the full CSP rules for your org.

I haven't tried this with a function app but I believe you need to set up a proxy for the function. Inside the proxy you specify the header(s) to include as part of the response. Then all requests to the function return back the header(s) you specified. There is a blog article on that here.

Again, though, be sure to review your company's CSP rules and ensure you're following all of them otherwise you're locking a screen door.

Answer 2

Hello @Dileep Mada

To enable the X-Content-Type-Options header globally for all pages in your Azure Function app, you can do one of the following:

1. Add the header in the web.config file if the application is hosted by Internet Information Services (IIS) 7
2. Add the header through the global Application_BeginRequest. Here's an example of how to add the header through the global Application_BeginRequest:

void Application_BeginRequest(object sender, EventArgs e) 
{ 
	this.Response.Headers["X-Content-Type-Options"] = "nosniff"; 
}

3. Implement a custom HTTP module. Here's an example of how to implement a custom HTTP module:

public class XContentTypeOptionsModule : IHttpModule 
{ 
	#region IHttpModule Members public
	# Add your code here.
}

---

I hope that this response has addressed your query and helped you overcome your challenges. If so, please mark this response as Answered. This will not only acknowledge our efforts, but also assist other community members who may be looking for similar solutions.