X-Content-Type-Options header

The HTTP X-Content-Type-Options response header indicates that the MIME types advertised in the Content-Type headers should be respected and not changed. The header allows you to avoid MIME type sniffing by specifying that the MIME types are deliberately configured.

Site security testers usually expect this header to be set (and that the Content-Type header is correctly set for all resources).

The nosniff directive has two effects depending on the context:

• Request blocking: For requests with a destination of "script" or "style", the browser blocks the response if the MIME type doesn't match an expected type (a JavaScript MIME type for scripts, or text/css for stylesheets). See the Fetch specification for details.
• MIME type sniffing disabled: For other response types, including navigations to a new HTML document, the browser uses the supplied Content-Type as-is instead of examining the content to infer the type. For example, if a server sends a response with Content-Type: text/plain and X-Content-Type-Options: nosniff, the browser will not interpret it as HTML, even if the content contains HTML markup. This prevents XSS-attacks where user-uploaded content is executed as an HTML document, even if the browser has specified that it should be treated as plain text (or some other type). See the MIME Sniffing specification for details.