{"action":"opened","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/17613","labels_url":"https://api.github.com/repos/owncloud/core/issues/17613/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/17613/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/17613/events","html_url":"https://github.com/owncloud/core/issues/17613","id":94729750,"number":17613,"title":"Security & Setup Warnings for X-Content-Type-Options and X-Frame-Options","user":{"login":"4fd81048a9cd8a3fd43f1f4e52f84181","id":10030990,"avatar_url":"https://avatars.githubusercontent.com/u/10030990?v=3","gravatar_id":"","url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181","html_url":"https://github.com/4fd81048a9cd8a3fd43f1f4e52f84181","followers_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/followers","following_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/following{/other_user}","gists_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/gists{/gist_id}","starred_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/subscriptions","organizations_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/orgs","repos_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/repos","events_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/events{/privacy}","received_events_url":"https://api.github.com/users/4fd81048a9cd8a3fd43f1f4e52f84181/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-13T14:10:36Z","updated_at":"2015-07-13T14:10:36Z","closed_at":null,"body":"### Steps to reproduce\r\n1. View the admin page\r\n\r\n### Expected behaviour\r\nNo warnings\r\n\r\n### Actual behaviour\r\n```\r\nThe \"X-Content-Type-Options\" HTTP header is not configured to equal to \"nosniff\". This is a potential security or privacy risk and we recommend adjusting this setting.\r\nThe \"X-Frame-Options\" HTTP header is not configured to equal to \"SAMEORIGIN\". This is a potential security or privacy risk and we recommend adjusting this setting.\r\n```\r\n\r\n### Server configuration\r\n**Operating system**: Ubuntu 15.04\r\n\r\n**Web server:**  Apache/2.4.10 (Ubuntu)\r\n\r\n**Database:** postgres (PostgreSQL) 9.4.4\r\n\r\n**PHP version:** PHP Version 5.6.4-4ubuntu6.2\r\n\r\n**ownCloud version:** ownCloud 8.1.0 (stable)\r\n\r\n**Updated from an older ownCloud or fresh install:** Updated\r\n\r\n### Details\r\n```\r\ncurl -I https://www.buchananworldcorp.com/owncloud/\r\nHTTP/1.1 200 OK\r\nDate: Mon, 13 Jul 2015 13:50:36 GMT\r\nServer: Apache/2.4.10 (Ubuntu)\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nX-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nPragma: no-cache\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src *; font-src 'self' data:; media-src *; connect-src *\r\nSet-Cookie: oc9a1e2ea845=e7mao7domb5cokpjki09evlb56; path=/owncloud; HttpOnly; Secure\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\nX-Robots-Tag: none\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Type: text/html; charset=UTF-8\r\n```\r\n\r\nThese headers are being set twice in the response.  In Issue #15342 LukasReschke suggests that this is likely the problem.  (Actually two problems, the headers should not be set twice and the check should handle the header appearing twice)\r\n\r\nI found that these headers were getting set in /etc/apache2/mods-enabled/ssl.conf and in .htaccess.\r\n\r\nIn /etc/apache2/mods-enabled/ssl.conf I commented out these two lines, reloaded Apache and the warnings went away.\r\n```\r\n#Header always set X-Frame-Options DENY\r\n#Header always set X-Content-Type-Options nosniff\r\n```\r\n\r\n"}}