Detections
Analytics

1.114 Ensure 'Enable strict MIME type checking for worker scripts' is set to 'Enabled'

Information

This policy setting controls whether strict MIME type checking is used for worker scripts.

The recommended state for this setting is: Enabled.

Note: Microsoft Edge uses strict MIME type checking by default. Enabling this policy enforces the default behavior via policy and prevents administrators from disabling it for compatibility purposes.

Lax MIME type checking allows resources to load as executable scripts when they were not intended to be used that way. An attacker could exploit this behavior to deliver malicious content with a non-JavaScript MIME type that the browser would still execute as a worker script, bypassing content type restrictions that would otherwise prevent its execution.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Administrative Templates\Microsoft Edge\Enable strict MIME type checking for worker scripts

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft.

Impact:

Web applications that rely on worker scripts served with legacy or non-standard MIME types will fail to load those scripts. Organizations with such legacy applications will need to update their server configurations to serve worker scripts with the correct JavaScript MIME type.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16

Plugin: Windows

Control ID: e6d57dc39653d11c64c10db31b849d9f36409cb4817eae9f2d1159d3a5938ea0