X-Content-Type-Options

The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.

This header was introduced by Microsoft in IE 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.

Site security testers usually expect this header to be set.

Note: X-Content-Type-Options only apply request-blocking due to nosniff for request destinations of "script" and "style". However, it also enables Cross-Origin Read Blocking (CORB) for HTML, TXT, JSON and XML files (excluding SVG image/svg+xml).

Syntax

X-Content-Type-Options: nosniff

Directives

nosniff

Blocks a request if the request destination is of type

• "style" and the MIME type is not text/css, or
• "script" and the MIME type is not a JavaScript MIME type

Enables Cross-Origin Read Blocking for the MIME-types

• text/html
• text/plain
• text/json, application/json or any other type with a JSON extension: */*+json
• text/xml, application/xml or any other type with an XML extension: */*+xml (excluding image/svg+xml)

Specifications

Browser compatibility

See also

• Content-Type
• The original definition of X-Content-Type-Options by Microsoft.
• The Mozilla Observatory tool testing the configuration (including this header) of Web sites for safety and security
• Mitigating MIME Confusion Attacks in Firefox
• Cross-Origin Read Blocking (CORB)
• Google Docs CORB explainer