Setting X-Download-Options: noopen - htaccess

[ryanhallinger]

Hi there,

It seems that Litespeed doesn't natively set X-Download-Options: noopen. It also appears that it doesn't respect/support the option when it is declared in the .htaccess file.

Is there an option to enable support for it?

 

[Pong]

seems it is a header for IE.
https://github.com/Fyrd/caniuse/issues/3388
You can try "header set"

https://httpd.apache.org/docs/current/mod/mod_headers.html

but from hight level, why you need it?

 

[serpent_driver]

Is there an option to enable support for it?

Check this out:
https://www.litespeedtech.com/suppo...-opening-it-on-the-browser.18966/#post-112308

 

[ryanhallinger]

seems it is a header for IE.
https://github.com/Fyrd/caniuse/issues/3388
You can try "header set"

https://httpd.apache.org/docs/current/mod/mod_headers.html

but from hight level, why you need it?

Thanks Pong. Do you mean "Header set X-Download-Options: noopen"? If yes, it does not seem to support the directive. The purpose is to minimize in-context XSS attacks.

 

[ryanhallinger]

Check this out:
https://www.litespeedtech.com/suppo...-opening-it-on-the-browser.18966/#post-112308

Thank serpent_driver. I'll explore it further. It would be awesome if there is native support for it. It's a common configuration in Rails for example.

 

[Pong]

I can get header set without any issue;

Header set X-Download-Options "noopen"

then

content-encoding: br
content-length: 17880
content-type: text/html; charset=UTF-8
date: Tue, 20 Oct 2020 19:03:30 GMT
etag: "1-1602771591;br"
link: <https://ddddd.quicserver.com/index.php/wp-json/>; rel="https://api.w.org/"
link: </wp-content/themes/twentyseventeen/style.css?ver=4.9.15>; rel=preload; as=style,</wp-includes/js/jquery/jquery.js?ver=1.12.4>; rel=preload; as=script,</wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1>; rel=preload; as=script,</wp-content/themes/twentyseventeen/assets/js/skip-link-focus-fix.js?ver=1.0>; rel=preload; as=script,</wp-content/themes/twentyseventeen/assets/js/global.js?ver=1.0>; rel=preload; as=script,</wp-content/themes/twentyseventeen/assets/js/jquery.scrollTo.js?ver=2.1.2>; rel=preload; as=script,</wp-includes/js/wp-embed.min.js?ver=4.9.15>; rel=preload; as=script
server: LiteSpeed/5.4.10 Enterprise
status: 200
vary: Accept-Encoding
x-download-options: noopen
x-litespeed-cache: hit