Serve downloads with nosniff and a sandbox CSP

2026-09-08 20:18:52 +02:00
parent b3dbc1524d
commit cee69470e0
2 changed files with 12 additions and 0 deletions
@@ -45,6 +45,10 @@ Downloads support range requests, so an interrupted transfer can be resumed:
 curl -C - -O https://beam.example.com/x123abcx/myfile.txt
 ```

+Uploaded content is served with `X-Content-Type-Options: nosniff` and
+`Content-Security-Policy: sandbox`, so an uploaded HTML or SVG file opens as a
+sandboxed, script-free document instead of running on the beam origin.
+
 ### Endpoints

 | Method       | Path                 | Purpose                                  |