Adds the option to disable the x-content-type-options header

README.rst

@@ -113,6 +113,9 @@ Options
    `X-Download-Options <https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/jj542450(v=vs.85)?redirectedfrom=MSDN>`_
    header to ``noopen`` to prevent IE >= 8 to from opening file downloads
    directly and only save them instead.
+-  ``x_content_type_options``, default ``True``, Protects against MIME sniffing vulnerabilities.
+-  ``x_xss_protection``, default ``True``, Protects against cross-site scripting (XSS) attacks.
+
 
 Per-view options
 ~~~~~~~~~~~~~~~~

flask_talisman/talisman.py

@@ -76,7 +76,9 @@ def init_app(
             content_security_policy_nonce_in=None,
             referrer_policy=DEFAULT_REFERRER_POLICY,
             session_cookie_secure=True,
-            session_cookie_http_only=True):
+            session_cookie_http_only=True,
+            x_content_type_options=True,
+            x_xss_protection=True):
         """
         Initialization.
 
@@ -116,6 +118,9 @@ def init_app(
                 session cookie.
             force_file_save: Prevents the user from opening a file download
                 directly on >= IE 8
+            x_content_type_options: Prevents MIME type sniffing
+            x_xss_protection: Prevents the page from loading when the browser
+                detects reflected cross-site scripting attacks
 
         See README.rst for a detailed description of each option.
         """
@@ -166,6 +171,10 @@ def init_app(
 
         self.force_file_save = force_file_save
 
+        self.x_content_type_options = x_content_type_options
+
+        self.x_xss_protection = x_xss_protection
+
         self.app = app
 
         app.before_request(self._force_https)
@@ -284,8 +293,11 @@ def _set_frame_options_headers(self, headers, options):
                 options['frame_options_allow_from'])
 
     def _set_content_security_policy_headers(self, headers, options):
-        headers['X-XSS-Protection'] = '1; mode=block'
-        headers['X-Content-Type-Options'] = 'nosniff'
+        if self.x_xxs_protection:
+            headers['X-XSS-Protection'] = '1; mode=block'
+
+        if self.x_content_type_options:
+            headers['X-Content-Type-Options'] = 'nosniff'
 
         if self.force_file_save:
             headers['X-Download-Options'] = 'noopen'