Anna: Removed redundant bracket.

2019-09-04T08:09:45Z

Removed redundant bracket.

P.Wiaderny: Created page with "When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to ma..."

2019-08-21T10:51:12Z

Created page with "When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to ma..."

New page

When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to make the folder publicly accessible, so all the files are served through the web server. If you rely on your web server to serve the files uploaded with CKFinder, you should take additional steps to make sure the files are served in a secure way.

Let us assume that you have configured your CKFinder to allow uploading of avi files. Even if the avi file is then served with a valid Content-Type: <code>video/x-msvideo</code> header, some browsers may ignore this information and perform additional checks on the raw file contents. If any HTML-like data is detected in the file content, the browser may decide to ignore information about the content type and handle the served content as if it was a regular web page. This behavior is called [https://en.wikipedia.org/wiki/Content_sniffing content sniffing] (also known as ''media type sniffing'' or ''MIME sniffing''), and in some circumstances, it may lead to security issues (for example, it may open door for XSS attacks)).

To avoid content sniffing, you should make sure that your server adds the <code>X-Content-Type-Options: nosniff</code> header to all HTTP responses when serving files from the publicly available folder. The <code>X-Content-Type-Options</code> response HTTP header is a marker used by the server to indicate that the MIME type set by the <code>Content-Type</code> header should not be changed and should be followed. As a result, the browser does not perform any content sniffing on the received content.

@@ Line 1: / Line 1: @@
 When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to make the folder publicly accessible, so all the files are served through the web server. If you rely on your web server to serve the files uploaded with CKFinder, you should take additional steps to make sure the files are served in a secure way.
-Let us assume that you have configured your CKFinder to allow uploading of avi files. Even if the avi file is then served with a valid Content-Type: <code>video/x-msvideo</code> header, some browsers may ignore this information and perform additional checks on the raw file contents. If any HTML-like data is detected in the file content, the browser may decide to ignore information about the content type and handle the served content as if it was a regular web page. This behavior is called [https://en.wikipedia.org/wiki/Content_sniffing content sniffing] (also known as ''media type sniffing'' or ''MIME sniffing''), and in some circumstances, it may lead to security issues (for example, it may open door for XSS attacks)).
+Let us assume that you have configured your CKFinder to allow uploading of avi files. Even if the avi file is then served with a valid Content-Type: <code>video/x-msvideo</code> header, some browsers may ignore this information and perform additional checks on the raw file contents. If any HTML-like data is detected in the file content, the browser may decide to ignore information about the content type and handle the served content as if it was a regular web page. This behavior is called [https://en.wikipedia.org/wiki/Content_sniffing content sniffing] (also known as ''media type sniffing'' or ''MIME sniffing''), and in some circumstances, it may lead to security issues (for example, it may open door for XSS attacks).
 To avoid content sniffing, you should make sure that your server adds the <code>X-Content-Type-Options: nosniff</code> header to all HTTP responses when serving files from the publicly available folder. The <code>X-Content-Type-Options</code> response HTTP header is a marker used by the server to indicate that the MIME type set by the <code>Content-Type</code> header should not be changed and should be followed. As a result, the browser does not perform any content sniffing on the received content.

Template:Ckfinder 2.x Securing a Publicly Accessible Folder - Revision history

Anna: Removed redundant bracket.

P.Wiaderny: Created page with "When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to ma..."