0

I have an application which is a set of Java Web Services and some static content (HTML, XML, JavaScript, etc.). I know that JavaScript has a limited character encoding that is possible, but HTML and XML can use various character encodings. I happen to know that all of these files are UTF-8 encoded. The WebSphere application server that I am using properly sets the Content-Type to 'text/html; charset=utf-8' for the HTML, but not for JavaScript or XML. They get the Content-Type header set to 'application/javascript' and 'text/xml' respectively. My security folks are telling me that ot specifying the charset for the XML files is a vulnerability. Remember these are static files.

On an IBM HTTPD web server (in front of the WebSphere application server) is there a directive that I can use to add the character encoding to the content type of 'text' types? On WebSphere is there a directive I can use to set the default character encoding for text types? I assume that after I "fix" this for the XML files that I will then be asked to fix it for CSS files, JavaScript files, etc. I would rather fix it once and be done.

If this question has been asked before, please provide the URL. I did find this question, but it is not the same. I am looking into the feasibility of this answer, but there are many folders and I would rather not have to remember to add a .htaccess file with this directive to each one.

covener
  • 17,402
  • 2
  • 31
  • 45
Patrick O'Hara
  • 557
  • 1
  • 6
  • 17

2 Answers2

1

You can just append AddDefaultCharset utf-8 to httpd.conf and everything will go out with that charset appended to it, even content generated by the application server. htaccess is not necessary and not useful for appserver content.

If you find you need to blacklist context roots, extensions, or anything else, sue <LocationMatch> with AddDefaultCharset off.

Unfortunately Header edit Content-Type... will not work in IBM HTTP Server prior to V9. In V9 this allows you to easily cherry pick the current Content-Type:

Header always edit Content-Type ^(text/html)$ "$1 ; charset=utf8" Header always edit Content-Type ^(application/javascript)$ "$1 ; charset=utf8"

covener
  • 17,402
  • 2
  • 31
  • 45
0

Just as same as covener described:

Add the following lines into the conf/httpd.conf file:

AddDefaultCharset utf-8
AddCharset utf-8 .html .js .css
<Location />
   Header always edit Content-Type ^(text/html)$ "$1; charset=utf8"
   Header always edit Content-Type ^(application/javascript)$ "$1; charset=utf8"
   RewriteRule ^(.*)$ $1 [R=200,L]
</Location>

and it should work.

BWappsAndmore
  • 491
  • 3
  • 17