Skip to content

Commit 30c0937

Browse files
MichaIngbackportbot-nextcloud[bot]
MichaIng
authored and
backportbot-nextcloud[bot]
committed
Change X-Robots-Tag header from "none" to "noindex, nofollow"
While "none" is indeed equivalent to "noindex, nofollow" for Google, but seems to be not supported by Bing and probably other search engines. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name#other_metadata_names https://developers.google.com/search/docs/crawling-indexing/robots-meta-tag?hl=de#comma-separated-list https://www.bing.com/webmasters/help/which-robots-metatags-does-bing-support-5198d240 Signed-off-by: MichaIng <micha@dietpi.com>
1 parent b8cff5e commit 30c0937

File tree

12 files changed

+80
-37
lines changed

12 files changed

+80
-37
lines changed

‎.htaccess‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
Header always set X-Permitted-Cross-Domain-Policies "none"
3232

3333
Header onsuccess unset X-Robots-Tag
34-
Header always set X-Robots-Tag "none"
34+
Header always set X-Robots-Tag "noindex, nofollow"
3535

3636
Header onsuccess unset X-XSS-Protection
3737
Header always set X-XSS-Protection "1; mode=block"

‎build/integration/features/carddav.feature‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Feature: carddav
4646
|X-Content-Type-Options |nosniff|
4747
|X-Frame-Options|SAMEORIGIN|
4848
|X-Permitted-Cross-Domain-Policies|none|
49-
|X-Robots-Tag|none|
49+
|X-Robots-Tag|noindex, nofollow|
5050
|X-XSS-Protection|1; mode=block|
5151

5252
Scenario: Exporting the picture of ones own contact
@@ -60,5 +60,5 @@ Feature: carddav
6060
|X-Content-Type-Options |nosniff|
6161
|X-Frame-Options|SAMEORIGIN|
6262
|X-Permitted-Cross-Domain-Policies|none|
63-
|X-Robots-Tag|none|
63+
|X-Robots-Tag|noindex, nofollow|
6464
|X-XSS-Protection|1; mode=block|

‎build/integration/features/dav-v2.feature‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Feature: dav-v2
2727
|X-Content-Type-Options |nosniff|
2828
|X-Frame-Options|SAMEORIGIN|
2929
|X-Permitted-Cross-Domain-Policies|none|
30-
|X-Robots-Tag|none|
30+
|X-Robots-Tag|noindex, nofollow|
3131
|X-XSS-Protection|1; mode=block|
3232
And Downloaded content should start with "Welcome to your Nextcloud account!"
3333

‎build/integration/features/webdav-related.feature‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ Feature: webdav-related
5353
And User "user0" moves file "/textfile0.txt" to "/testshare/textfile0.txt"
5454
And the HTTP status code should be "403"
5555
When Downloading file "/testshare/textfile0.txt"
56-
Then the HTTP status code should be "404"
56+
Then the HTTP status code should be "404"
5757

5858
Scenario: Moving a file to overwrite a file in a folder with no permissions
5959
Given using old dav path
@@ -251,7 +251,7 @@ Feature: webdav-related
251251
|X-Content-Type-Options |nosniff|
252252
|X-Frame-Options|SAMEORIGIN|
253253
|X-Permitted-Cross-Domain-Policies|none|
254-
|X-Robots-Tag|none|
254+
|X-Robots-Tag|noindex, nofollow|
255255
|X-XSS-Protection|1; mode=block|
256256
And Downloaded content should start with "Welcome to your Nextcloud account!"
257257

‎core/js/setupchecks.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -621,13 +621,13 @@
621621
if (xhr.status === 200) {
622622
var securityHeaders = {
623623
'X-Content-Type-Options': ['nosniff'],
624-
'X-Robots-Tag': ['none'],
624+
'X-Robots-Tag': ['noindex, nofollow'],
625625
'X-Frame-Options': ['SAMEORIGIN', 'DENY'],
626626
'X-Permitted-Cross-Domain-Policies': ['none'],
627627
};
628628
for (var header in securityHeaders) {
629629
var option = securityHeaders[header][0];
630-
if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== option.toLowerCase()) {
630+
if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).replace(/, /, ',').toLowerCase() !== option.replace(/, /, ',').toLowerCase()) {
631631
var msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', {header: header, expected: option});
632632
if(xhr.getResponseHeader(header) && securityHeaders[header].length > 1 && xhr.getResponseHeader(header).toLowerCase() === securityHeaders[header][1].toLowerCase()) {
633633
msg = t('core', 'The "{header}" HTTP header is not set to "{expected}". Some features might not work correctly, as it is recommended to adjust this setting accordingly.', {header: header, expected: option});

‎core/js/tests/specs/setupchecksSpec.js‎

Lines changed: 66 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1490,7 +1490,7 @@ describe('OC.SetupChecks tests', function() {
14901490
msg: 'The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
14911491
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
14921492
}, {
1493-
msg: 'The "X-Robots-Tag" HTTP header is not set to "none". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
1493+
msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
14941494
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
14951495
}, {
14961496
msg: 'The "X-Frame-Options" HTTP header is not set to "SAMEORIGIN". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
@@ -1517,7 +1517,7 @@ describe('OC.SetupChecks tests', function() {
15171517
suite.server.requests[0].respond(
15181518
200,
15191519
{
1520-
'X-Robots-Tag': 'none',
1520+
'X-Robots-Tag': 'noindex, nofollow',
15211521
'X-Frame-Options': 'SAMEORIGIN',
15221522
'Strict-Transport-Security': 'max-age=15768000;preload',
15231523
'X-Permitted-Cross-Domain-Policies': 'none',
@@ -1548,7 +1548,7 @@ describe('OC.SetupChecks tests', function() {
15481548
{
15491549
'X-XSS-Protection': '1; mode=block',
15501550
'X-Content-Type-Options': 'nosniff',
1551-
'X-Robots-Tag': 'none',
1551+
'X-Robots-Tag': 'noindex, nofollow',
15521552
'X-Frame-Options': 'SAMEORIGIN',
15531553
'Strict-Transport-Security': 'max-age=15768000',
15541554
'X-Permitted-Cross-Domain-Policies': 'none',
@@ -1562,6 +1562,49 @@ describe('OC.SetupChecks tests', function() {
15621562
});
15631563
});
15641564

1565+
describe('check X-Robots-Tag header', function() {
1566+
it('should return no message if X-Robots-Tag is set to noindex,nofollow without space', function(done) {
1567+
protocolStub.returns('https');
1568+
var result = OC.SetupChecks.checkGeneric();
1569+
suite.server.requests[0].respond(200, {
1570+
'Strict-Transport-Security': 'max-age=15768000',
1571+
'X-XSS-Protection': '1; mode=block',
1572+
'X-Content-Type-Options': 'nosniff',
1573+
'X-Robots-Tag': 'noindex,nofollow',
1574+
'X-Frame-Options': 'SAMEORIGIN',
1575+
'X-Permitted-Cross-Domain-Policies': 'none',
1576+
'Referrer-Policy': 'no-referrer',
1577+
});
1578+
result.done(function( data, s, x ){
1579+
expect(data).toEqual([]);
1580+
done();
1581+
});
1582+
});
1583+
1584+
it('should return a message if X-Robots-Tag is set to none', function(done) {
1585+
protocolStub.returns('https');
1586+
var result = OC.SetupChecks.checkGeneric();
1587+
suite.server.requests[0].respond(200, {
1588+
'Strict-Transport-Security': 'max-age=15768000',
1589+
'X-XSS-Protection': '1; mode=block',
1590+
'X-Content-Type-Options': 'nosniff',
1591+
'X-Robots-Tag': 'none',
1592+
'X-Frame-Options': 'SAMEORIGIN',
1593+
'X-Permitted-Cross-Domain-Policies': 'none',
1594+
'Referrer-Policy': 'no-referrer',
1595+
});
1596+
result.done(function( data, s, x ){
1597+
expect(data).toEqual([
1598+
{
1599+
msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
1600+
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
1601+
}
1602+
]);
1603+
done();
1604+
});
1605+
});
1606+
});
1607+
15651608
describe('check X-XSS-Protection header', function() {
15661609
it('should return no message if X-XSS-Protection is set to 1; mode=block; report=https://example.com', function(done) {
15671610
protocolStub.returns('https');
@@ -1571,7 +1614,7 @@ describe('OC.SetupChecks tests', function() {
15711614
'Strict-Transport-Security': 'max-age=15768000',
15721615
'X-XSS-Protection': '1; mode=block; report=https://example.com',
15731616
'X-Content-Type-Options': 'nosniff',
1574-
'X-Robots-Tag': 'none',
1617+
'X-Robots-Tag': 'noindex, nofollow',
15751618
'X-Frame-Options': 'SAMEORIGIN',
15761619
'X-Permitted-Cross-Domain-Policies': 'none',
15771620
'Referrer-Policy': 'no-referrer',
@@ -1591,7 +1634,7 @@ describe('OC.SetupChecks tests', function() {
15911634
'Strict-Transport-Security': 'max-age=15768000',
15921635
'X-XSS-Protection': '1; mode=block',
15931636
'X-Content-Type-Options': 'nosniff',
1594-
'X-Robots-Tag': 'none',
1637+
'X-Robots-Tag': 'noindex, nofollow',
15951638
'X-Frame-Options': 'SAMEORIGIN',
15961639
'X-Permitted-Cross-Domain-Policies': 'none',
15971640
'Referrer-Policy': 'no-referrer',
@@ -1611,7 +1654,7 @@ describe('OC.SetupChecks tests', function() {
16111654
'Strict-Transport-Security': 'max-age=15768000',
16121655
'X-XSS-Protection': '1',
16131656
'X-Content-Type-Options': 'nosniff',
1614-
'X-Robots-Tag': 'none',
1657+
'X-Robots-Tag': 'noindex, nofollow',
16151658
'X-Frame-Options': 'SAMEORIGIN',
16161659
'X-Permitted-Cross-Domain-Policies': 'none',
16171660
'Referrer-Policy': 'no-referrer',
@@ -1636,7 +1679,7 @@ describe('OC.SetupChecks tests', function() {
16361679
'Strict-Transport-Security': 'max-age=15768000',
16371680
'X-XSS-Protection': '0',
16381681
'X-Content-Type-Options': 'nosniff',
1639-
'X-Robots-Tag': 'none',
1682+
'X-Robots-Tag': 'noindex, nofollow',
16401683
'X-Frame-Options': 'SAMEORIGIN',
16411684
'X-Permitted-Cross-Domain-Policies': 'none',
16421685
'Referrer-Policy': 'no-referrer',
@@ -1663,7 +1706,7 @@ describe('OC.SetupChecks tests', function() {
16631706
'Strict-Transport-Security': 'max-age=15768000',
16641707
'X-XSS-Protection': '1; mode=block',
16651708
'X-Content-Type-Options': 'nosniff',
1666-
'X-Robots-Tag': 'none',
1709+
'X-Robots-Tag': 'noindex, nofollow',
16671710
'X-Frame-Options': 'SAMEORIGIN',
16681711
'X-Permitted-Cross-Domain-Policies': 'none',
16691712
'Referrer-Policy': 'no-referrer',
@@ -1683,7 +1726,7 @@ describe('OC.SetupChecks tests', function() {
16831726
'Strict-Transport-Security': 'max-age=15768000',
16841727
'X-XSS-Protection': '1; mode=block',
16851728
'X-Content-Type-Options': 'nosniff',
1686-
'X-Robots-Tag': 'none',
1729+
'X-Robots-Tag': 'noindex, nofollow',
16871730
'X-Frame-Options': 'SAMEORIGIN',
16881731
'X-Permitted-Cross-Domain-Policies': 'none',
16891732
'Referrer-Policy': 'no-referrer-when-downgrade',
@@ -1703,7 +1746,7 @@ describe('OC.SetupChecks tests', function() {
17031746
'Strict-Transport-Security': 'max-age=15768000',
17041747
'X-XSS-Protection': '1; mode=block',
17051748
'X-Content-Type-Options': 'nosniff',
1706-
'X-Robots-Tag': 'none',
1749+
'X-Robots-Tag': 'noindex, nofollow',
17071750
'X-Frame-Options': 'SAMEORIGIN',
17081751
'X-Permitted-Cross-Domain-Policies': 'none',
17091752
'Referrer-Policy': 'strict-origin',
@@ -1723,7 +1766,7 @@ describe('OC.SetupChecks tests', function() {
17231766
'Strict-Transport-Security': 'max-age=15768000',
17241767
'X-XSS-Protection': '1; mode=block',
17251768
'X-Content-Type-Options': 'nosniff',
1726-
'X-Robots-Tag': 'none',
1769+
'X-Robots-Tag': 'noindex, nofollow',
17271770
'X-Frame-Options': 'SAMEORIGIN',
17281771
'X-Permitted-Cross-Domain-Policies': 'none',
17291772
'Referrer-Policy': 'strict-origin-when-cross-origin',
@@ -1743,7 +1786,7 @@ describe('OC.SetupChecks tests', function() {
17431786
'Strict-Transport-Security': 'max-age=15768000',
17441787
'X-XSS-Protection': '1; mode=block',
17451788
'X-Content-Type-Options': 'nosniff',
1746-
'X-Robots-Tag': 'none',
1789+
'X-Robots-Tag': 'noindex, nofollow',
17471790
'X-Frame-Options': 'SAMEORIGIN',
17481791
'X-Permitted-Cross-Domain-Policies': 'none',
17491792
'Referrer-Policy': 'same-origin',
@@ -1763,7 +1806,7 @@ describe('OC.SetupChecks tests', function() {
17631806
'Strict-Transport-Security': 'max-age=15768000',
17641807
'X-XSS-Protection': '1; mode=block',
17651808
'X-Content-Type-Options': 'nosniff',
1766-
'X-Robots-Tag': 'none',
1809+
'X-Robots-Tag': 'noindex, nofollow',
17671810
'X-Frame-Options': 'SAMEORIGIN',
17681811
'X-Permitted-Cross-Domain-Policies': 'none',
17691812
'Referrer-Policy': 'origin',
@@ -1788,7 +1831,7 @@ describe('OC.SetupChecks tests', function() {
17881831
'Strict-Transport-Security': 'max-age=15768000',
17891832
'X-XSS-Protection': '1; mode=block',
17901833
'X-Content-Type-Options': 'nosniff',
1791-
'X-Robots-Tag': 'none',
1834+
'X-Robots-Tag': 'noindex, nofollow',
17921835
'X-Frame-Options': 'SAMEORIGIN',
17931836
'X-Permitted-Cross-Domain-Policies': 'none',
17941837
'Referrer-Policy': 'origin-when-cross-origin',
@@ -1813,7 +1856,7 @@ describe('OC.SetupChecks tests', function() {
18131856
'Strict-Transport-Security': 'max-age=15768000',
18141857
'X-XSS-Protection': '1; mode=block',
18151858
'X-Content-Type-Options': 'nosniff',
1816-
'X-Robots-Tag': 'none',
1859+
'X-Robots-Tag': 'noindex, nofollow',
18171860
'X-Frame-Options': 'SAMEORIGIN',
18181861
'X-Permitted-Cross-Domain-Policies': 'none',
18191862
'Referrer-Policy': 'unsafe-url',
@@ -1840,7 +1883,7 @@ describe('OC.SetupChecks tests', function() {
18401883
{
18411884
'X-XSS-Protection': '1; mode=block',
18421885
'X-Content-Type-Options': 'nosniff',
1843-
'X-Robots-Tag': 'none',
1886+
'X-Robots-Tag': 'noindex, nofollow',
18441887
'X-Frame-Options': 'SAMEORIGIN',
18451888
'X-Permitted-Cross-Domain-Policies': 'none',
18461889
'Referrer-Policy': 'no-referrer',
@@ -1886,7 +1929,7 @@ describe('OC.SetupChecks tests', function() {
18861929
{
18871930
'X-XSS-Protection': '1; mode=block',
18881931
'X-Content-Type-Options': 'nosniff',
1889-
'X-Robots-Tag': 'none',
1932+
'X-Robots-Tag': 'noindex, nofollow',
18901933
'X-Frame-Options': 'SAMEORIGIN',
18911934
'X-Permitted-Cross-Domain-Policies': 'none',
18921935
'Referrer-Policy': 'no-referrer',
@@ -1911,7 +1954,7 @@ describe('OC.SetupChecks tests', function() {
19111954
'Strict-Transport-Security': 'max-age=15551999',
19121955
'X-XSS-Protection': '1; mode=block',
19131956
'X-Content-Type-Options': 'nosniff',
1914-
'X-Robots-Tag': 'none',
1957+
'X-Robots-Tag': 'noindex, nofollow',
19151958
'X-Frame-Options': 'SAMEORIGIN',
19161959
'X-Permitted-Cross-Domain-Policies': 'none',
19171960
'Referrer-Policy': 'no-referrer',
@@ -1936,7 +1979,7 @@ describe('OC.SetupChecks tests', function() {
19361979
'Strict-Transport-Security': 'iAmABogusHeader342',
19371980
'X-XSS-Protection': '1; mode=block',
19381981
'X-Content-Type-Options': 'nosniff',
1939-
'X-Robots-Tag': 'none',
1982+
'X-Robots-Tag': 'noindex, nofollow',
19401983
'X-Frame-Options': 'SAMEORIGIN',
19411984
'X-Permitted-Cross-Domain-Policies': 'none',
19421985
'Referrer-Policy': 'no-referrer',
@@ -1960,7 +2003,7 @@ describe('OC.SetupChecks tests', function() {
19602003
'Strict-Transport-Security': 'max-age=15768000',
19612004
'X-XSS-Protection': '1; mode=block',
19622005
'X-Content-Type-Options': 'nosniff',
1963-
'X-Robots-Tag': 'none',
2006+
'X-Robots-Tag': 'noindex, nofollow',
19642007
'X-Frame-Options': 'SAMEORIGIN',
19652008
'X-Permitted-Cross-Domain-Policies': 'none',
19662009
'Referrer-Policy': 'no-referrer',
@@ -1980,7 +2023,7 @@ describe('OC.SetupChecks tests', function() {
19802023
'Strict-Transport-Security': 'max-age=99999999',
19812024
'X-XSS-Protection': '1; mode=block',
19822025
'X-Content-Type-Options': 'nosniff',
1983-
'X-Robots-Tag': 'none',
2026+
'X-Robots-Tag': 'noindex, nofollow',
19842027
'X-Frame-Options': 'SAMEORIGIN',
19852028
'X-Permitted-Cross-Domain-Policies': 'none',
19862029
'Referrer-Policy': 'no-referrer',
@@ -2000,7 +2043,7 @@ describe('OC.SetupChecks tests', function() {
20002043
'Strict-Transport-Security': 'max-age=99999999; includeSubDomains',
20012044
'X-XSS-Protection': '1; mode=block',
20022045
'X-Content-Type-Options': 'nosniff',
2003-
'X-Robots-Tag': 'none',
2046+
'X-Robots-Tag': 'noindex, nofollow',
20042047
'X-Frame-Options': 'SAMEORIGIN',
20052048
'X-Permitted-Cross-Domain-Policies': 'none',
20062049
'Referrer-Policy': 'no-referrer',
@@ -2020,7 +2063,7 @@ describe('OC.SetupChecks tests', function() {
20202063
'Strict-Transport-Security': 'max-age=99999999; preload; includeSubDomains',
20212064
'X-XSS-Protection': '1; mode=block',
20222065
'X-Content-Type-Options': 'nosniff',
2023-
'X-Robots-Tag': 'none',
2066+
'X-Robots-Tag': 'noindex, nofollow',
20242067
'X-Frame-Options': 'SAMEORIGIN',
20252068
'X-Permitted-Cross-Domain-Policies': 'none',
20262069
'Referrer-Policy': 'no-referrer',

‎lib/private/legacy/OC_Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ public static function addSecurityHeaders() {
9999
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
100100
header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
101101
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
102-
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
102+
header('X-Robots-Tag: noindex, nofollow'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
103103
header('X-XSS-Protection: 1; mode=block'); // Enforce browser based XSS filters
104104
}
105105
}

‎lib/public/AppFramework/Http/Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -256,7 +256,7 @@ public function getHeaders() {
256256

257257
$this->headers['Content-Security-Policy'] = $this->getContentSecurityPolicy()->buildPolicy();
258258
$this->headers['Feature-Policy'] = $this->getFeaturePolicy()->buildPolicy();
259-
$this->headers['X-Robots-Tag'] = 'none';
259+
$this->headers['X-Robots-Tag'] = 'noindex, nofollow';
260260

261261
if ($this->ETag) {
262262
$mergeWith['ETag'] = '"' . $this->ETag . '"';

‎tests/data/setUploadLimit/htaccess‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
# Add security and privacy related headers
1212
Header set X-Content-Type-Options "nosniff"
1313
Header set X-XSS-Protection "1; mode=block"
14-
Header set X-Robots-Tag "none"
14+
Header set X-Robots-Tag "noindex, nofollow"
1515
Header set X-Frame-Options "SAMEORIGIN"
1616
SetEnv modHeadersAvailable true
1717
</IfModule>

‎tests/lib/AppFramework/Controller/ControllerTest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ public function testFormatDataResponseJSON() {
117117
'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'",
118118
'Feature-Policy' => "autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'",
119119
'X-Request-Id' => $this->request->getId(),
120-
'X-Robots-Tag' => 'none',
120+
'X-Robots-Tag' => 'noindex, nofollow',
121121
];
122122

123123
$response = $this->controller->customDataResponse(['hi']);

0 commit comments

Comments
 (0)