SSRS report drop down boxes and calendar controls are not populating after configuring X-Content-Type-Options: nosniff response header in IIS

Question

Recently we have added X-Content-Type-Options: nosniff header to IIS as a part of security fixes. then we started facing issue with SSRS reports are rending properly in IE11. we debugged with F12 options and identified the server is blocking SSRS report default java scripts. And the MIME types in report is text/javascript which is blocking by IIS.

If we remove these headers in IIS then report is working fine. So, is there any solution to make application works with keeping headers?

score 0 · Answer 1 · answered May 17 '17 at 18:06

I ran into this a little while back with the embedded report viewer in our web site. The way we got around it was to remove the header for that page. To do this you need a config.web file in the directory of the report viewer page that has the following in it:

<location path="ViewReport.aspx">
        <system.webServer>
                   <httpProtocol>
                       <customHeaders>
                           <remove name="X-Content-Type-Options" />
                </customHeaders>
                   </httpProtocol>
        </system.webServer>
    </location>

Hope this helps.

Shawn

SSRS report drop down boxes and calendar controls are not populating after configuring X-Content-Type-Options: nosniff response header in IIS

1 Answers1