HAP breaks when I use X-Content-Type-Options=nosniff

[KK20]

Just installed HAP but was having an issue getting it to work. Found the culprit in the end, I have X-Content-Type-Options set on my ISS server to stop MIME sniffing, this breaks HAP though (if I remove that header then HAP works just fine - tried on two completely different IIS servers with the same reproducible issue). Any thoughts? Id rather not disable this if possible.

[nickbro]

Do you have any error messages when browsing to HAP+ from the server which would give more indication as to what is causing HAP+ to throw a wobble?

[KK20]

I used IE11 developer mode to get the web page error message; take the header away and it works again immediately. We are using a real SSL cert, this is a subdomain of a working website (which works with the header).

here are three pictures, working, not working and the web page error

[nickbro]

Hmm looks like the HAP+ core javascript file isn't loading.

 

Can you browse to /hap/api/js/hap

 

If that comes up with an error then post that error here.

[KK20]

I can browse to that page without any F12 errors. The page looks the same with or without the header (a long string of code)

 

 

edit: a long shot, does HAP attempt to check MIME types at all? since the whole point of nosniff is to stop MIME sniffing, perhaps that is triggering something? I dropped the URL back to /api - that worked too, I had no idea there were so many api's available. /api/test returns "OK" if that is any help. the others I have tried return an index out of range aspx error.

Edited November 21, 2016 by KK20

[nickbro]

Hmm really odd. I come back to why force this feature off? I think by doing what you are doing (which in an asp.net application isn't needed) it isn't able to figure out that the hap file being presented is a javascript file. If you must have that header on for other sites, I would recommend having it removed in HAP application

[KK20]

I have removed the header for this site, not really an amazing issue; the header is just there as a security (good practice) reason. It is cure against mime sniffing attacks that is all. Oh well, thanks for getting back quickly though.