U4-6873 - Adding nosniff-header breaks PNG-images in Internet Explorer

Created by Jeffrey Schoemaker 24 Jul 2015, 15:07:24 Updated by Sebastiaan Janssen 05 Jan 2016, 09:55:06

Relates to: U4-629

Relates to: U4-694

Summary: If you add a png-image to the mediasection, Umbraco will create a .jpg-thumbnail, but this file isn't a real .jpg but actually a .png that is stored as a jpg. This issue has been in the Umbraco core since a few years, but we didn't have any issues (although it was wrong). A few weeks ago we had to add a security-header ("no-sniff") to all our websites and then Umbraco breaks, because Internet Explorer won't display the images any longer.

Details: https://our.umbraco.org/forum/umbraco-7/using-umbraco-7/66788-adding-nosniff-header-breaks-png-images-in-internet-explorer#comment-222740

Related issues:

Fix: https://github.com/umbraco/Umbraco-CMS/pull/747

We tested the code pretty good with several examples in different use cases and we think it will fix this issue and won't introduce other issues, but please test properly. If you upgrade your Umbraco with this fix new thumbnails will probably be generated by Umbraco (happens now too if the thumbnail gets deleted). But if your old code expect always a .jpg-thumbnail in your usercontrols/views/etcetera your code will not work any longer because now the proper. In that way you could see this is a "breaking" change.

Hope you like it,



Timo 27 Oct 2015, 15:02:14


Any update on this issue? I'll be at the hackathon next Thursday at the Umbraco UK festival and can answer any questions you'd might have.

Sebastiaan Janssen 14 Dec 2015, 13:21:40

I've updated this to be not backwards compatible as people are depending on image_thumb.jpg to exist for image.png and image.gif, so it's not technically breaking but it breaks the expected behavior.

Jeffrey Schoemaker 14 Dec 2015, 13:55:29

@sebastiaan Perfect! Any idea if it is going to be merged and in which version?

Sebastiaan Janssen 15 Dec 2015, 09:47:08

It will be in 7.4. I'm making it non-breaking by just copying the output to a _thumb.jpg as well, so basically doing what it did before. Then people can just choose what to use either the png/gif/tif or the jpg that's always there. Files are tiny so there's not much of a disk space concern.

Priority: Normal

Type: Bug

State: Fixed


Difficulty: Normal


Backwards Compatible: True

Fix Submitted: Pull request

Affected versions:

Due in version: 7.4.0, 7.3.5

Sprint: Sprint 5

Story Points: