Customers have added security headers to their SSL Offloading appliance to meet new security standards.  Now when launching a Public webApp, instead of the application properly launching the browser just displays the HTML code.

We've found that the X-Content-Type-Options=nosniff header is the root of the issue.

Currently the Public webApp type does not set a MIME type.  Thus when you tell the browser not to sniff the HTML for the MIME type it has no idea what to do, and just displays the HTML.

We are recommending not to set that security header if you are using Public webApps on your system.  Once we update the Public webApp code to set the MIME type, we will update this article.