This is why it's important to correctly set the Content-Type header when serving...

mkagenius · on Aug 10, 2016

Some browsers might try to sniff the mime type, so an additional header would help : "X-Content-Type-Options: nosniff"[1]

1. https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-...

michaelmior · on Aug 10, 2016

Thanks! I remembered something like that existing but I couldn't remember the header name :)

instakill · on Aug 11, 2016

Please elaborate on the part about UCG from a separate domain. Why is this?

jakobegger · on Aug 11, 2016

If someone uses this trick to upload a PNG like this to your server, and that person is tricked into running it as HTML, then that HTML has access to your cookies and can make make AJAX requests (circumvent same origin protection).

If user content is on a separate domain, they can't do that.

Also fishing is a lot easier when you're on the real domain...

michaelmior · on Aug 23, 2016

Sorry, didn't see this comment earlier. GitHub's blog post on why they did this gives some good insight.

https://github.com/blog/1452-new-github-pages-domain-github-...