backport of commit 55c0ece

hashicorp · Sep 11, 2024 · 9874595 · 9874595
1 parent 197e0f8
commit 9874595
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/.changelog/21704.txt b/.changelog/21704.txt
@@ -1,3 +1,3 @@
 ```release-note:security
-Explicitly set 'Content-Type' header to mitigate XSS vulnerability. 
+Explicitly set 'Content-Type' header to mitigate XSS vulnerability.
 ```
diff --git a/agent/http.go b/agent/http.go
@@ -351,12 +351,13 @@ func withRemoteAddrHandler(next http.Handler) http.Handler {
 func ensureContentTypeHeader(next http.Handler, logger hclog.Logger) http.Handler {
 
 	return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
+		next.ServeHTTP(resp, req)
+
 		val := resp.Header().Get(contentTypeHeader)
 		if val == "" {
 			resp.Header().Set(contentTypeHeader, plainContentType)
 			logger.Debug("warning: content-type header not explicitly set.", "request-path", req.URL)
 		}
-		next.ServeHTTP(resp, req)
 	})
 }