Fix no html only headers

[sarvaje]

Pull request checklist

Make sure you:

• Signed the Contributor License Agreement
• Followed the commit message guidelines

For non-trivial changes, please make sure you also:

• Added/Updated related documentation.
• Added/Updated related tests.

Short description of the change(s)

Fix #2342
Fix #2349

[Malvoz]

This is great! :)

Before closing #2342, I don't think we should overlook #2342 (comment):

X-Frame-Options might be relevant to any response really.

And aside from the potentially sizable list of content-types with the ability to fetch files, or execute scripts such as the common PDF (application/pdf) — CSP is also applicable to SVG (image/svg+xml).

[Malvoz]

@sarvaje Unless I'm missing something, I think you missed the occurrences of X-WebKit-CSP?

[sarvaje]

@sarvaje Unless I'm missing something, I think you missed the occurrences of X-WebKit-CSP?

@Malvoz you are not missing something, I miss that occurrence.

[sarvaje]

And aside from the potentially sizable list of content-types with the ability to fetch files, or execute scripts such as the common PDF (application/pdf) — CSP is also applicable to SVG (image/svg+xml).

Maybe we should think in having a new hint only for CSP.
@antross @molant @Malvoz what do you thing?

[molant]

There's #25
It's been in the backlog for a long time.

[sarvaje]

There's #25
It's been in the backlog for a long time.

Ups, I didn't remember that hehehe

[sarvaje]

Changes done!

[antross]

Looking good.

Can you add explicit test cases for application/xhtml+xml and text/xml too? Now that I'm looking at the code I'm not convinced it's going to handle the text/xml case correctly in particular.

I saw a few places X-Frame-Options still needs to be removed from the documentation (couldn't reference them since they were too far away from the diffs).

Also feel free to clean up any other redundant type specifications you see while we're in here.

[sarvaje]

it would be nice to have a second opinion about the changes in the servers configuration.