X-Content-Type-Options

O header de resposta HTTP X-Content-Type-Options é um marcador usado pelo servidor para indicar que os MIME types enviados pelos headers Content-Type não devem ser alterados e seguidos. Isto permite que o usuário opte por não participar do chamado MIME Type Sniffing ou, em outras palavras, é uma forma de dizer que os webmasters estão vendo o que você está fazendo.

Este header foi incluído pela Microsoft no IE 8 como uma maneira de webmasters serem capazes de bloquear o sniffing de conteúdo que acontecia na época, e podia transformar tipos MIME não executáveis em tipos executáveis. Desde então, outros browsers acataram a ideia mesmo que seus algoritmos de definição de MIME fossem menos agressivos.

Experts em segurança da informação geralmente esperam que este header esteja presente.

Nota: nosniff só se aplica para tipos "script" e "style". Também, aplicar nosniff em tipos de imagem provou-se ser incompatível com sites existentes.

Tipo do header Header de resposta
Alteração de nome proibida não

Sintaxe

X-Content-Type-Options: nosniff

Diretivas

nosniff
Bloqueia uma requisição se o tipo for:
  • "style" e o tipo MIME não é "text/css", ou
  • "script" e o tipo MIME não é um tipo JavaScript.

Especificações

Especificação Status Comentário
Fetch
The definition of 'X-Content-Type-Options definition' in that specification.		 Padrão em tempo real Definição inicial

Compatibilidade dos browsers

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
X-Content-Type-OptionsChrome Full support 64
Full support 64
Partial support 1
Notes
Notes Not supported for stylesheets.
Edge Full support 12Firefox Full support 50IE Full support 8Opera Full support YesSafari No support NoWebView Android Full support 64
Full support 64
Partial support Partial
Notes
Notes Not supported for stylesheets.
Chrome Android Full support 64
Full support 64
Partial support Partial
Notes
Notes Not supported for stylesheets.
Firefox Android Full support 50Opera Android Full support YesSafari iOS No support NoSamsung Internet Android Full support 9.0
Full support 9.0
Partial support Partial
Notes
Notes Not supported for stylesheets.

Legend

Full support  
Full support
No support  
No support
See implementation notes.
See implementation notes.

Veja também

Tópicos relacionados
  1. HTTP
  2. Guides:
  3. Resources and URIs
    1. Identifying resources on the Web
    2. Data URIs
    3. Introduction to MIME Types
    4. Complete list of MIME Types
    5. Choosing between www and non-www URLs
  4. HTTP guide
    1. Basics of HTTP
    2. Overview of HTTP
    3. Evolution of HTTP
    4. HTTP Messages
    5. A typical HTTP session
    6. Connection management in HTTP/1.x
    7. Protocol upgrade mechanism
  5. HTTP security
    1. Content Security Policy (CSP)
    2. HTTP Public Key Pinning (HPKP)
    3. HTTP Strict Transport Security (HSTS)
    4. Cookie security
    5. X-Content-Type-Options
    6. X-Frame-Options
    7. X-XSS-Protection
    8. Mozilla web security guidelines
    9. Mozilla Observatory
  6. HTTP access control (CORS)
  7. HTTP authentication
  8. HTTP caching
  9. HTTP compression
  10. HTTP conditional requests
  11. HTTP content negotiation
  12. HTTP cookies
  13. HTTP range requests
  14. HTTP redirects
  15. HTTP specifications
  16. Feature policy
  17. References:
  18. HTTP headers
    1. Accept
    2. Accept-CH
    3. Accept-CH-Lifetime
    4. Accept-Charset
    5. Accept-Encoding
    6. Accept-Language
    7. Accept-Patch
    8. Accept-Ranges
    9. Access-Control-Allow-Credentials
    10. Access-Control-Allow-Headers
    11. Access-Control-Allow-Methods
    12. Access-Control-Allow-Origin
    13. Access-Control-Expose-Headers
    14. Access-Control-Max-Age
    15. Access-Control-Request-Headers
    16. Access-Control-Request-Method
    17. Age
    18. Allow
    19. Alt-Svc
    20. Authorization
    21. Cache-Control
    22. Clear-Site-Data
    23. Conexão
    24. Content-Disposition [Traduzir]
    25. Content-Encoding [Traduzir]
    26. Content-Language
    27. Content-Length
    28. Content-Location
    29. Content-Range [Traduzir]
    30. Content-Security-Policy [Traduzir]
    31. Content-Security-Policy-Report-Only [Traduzir]
    32. Content-Type
    33. Cookie [Traduzir]
    34. Cookie2 [Traduzir]
    35. Cross-Origin-Resource-Policy [Traduzir]
    36. DNT [Traduzir]
    37. DPR [Traduzir]
    38. Date [Traduzir]
    39. Device-Memory [Traduzir]
    40. Digest [Traduzir]
    41. ETag [Traduzir]
    42. Early-Data [Traduzir]
    43. Expect [Traduzir]
    44. Expect-CT [Traduzir]
    45. Expires
    46. Feature-Policy [Traduzir]
    47. Forwarded [Traduzir]
    48. From [Traduzir]
    49. Host
    50. If-Match [Traduzir]
    51. If-Modified-Since
    52. If-None-Match [Traduzir]
    53. If-Range [Traduzir]
    54. If-Unmodified-Since
    55. Index [Traduzir]
    56. Keep-Alive
    57. Large-Allocation [Traduzir]
    58. Last-Modified
    59. Link [Traduzir]
    60. Location
    61. Origin [Traduzir]
    62. Pragma [Traduzir]
    63. Proxy-Authenticate [Traduzir]
    64. Proxy-Authorization [Traduzir]
    65. Public-Key-Pins [Traduzir]
    66. Public-Key-Pins-Report-Only [Traduzir]
    67. Range [Traduzir]
    68. Referer
    69. Referrer-Policy [Traduzir]
    70. Retry-After
    71. Save-Data [Traduzir]
    72. Sec-Fetch-Dest [Traduzir]
    73. Sec-Fetch-Mode [Traduzir]
    74. Sec-Fetch-Site [Traduzir]
    75. Sec-Fetch-User [Traduzir]
    76. Sec-WebSocket-Accept [Traduzir]
    77. Server
    78. Server-Timing [Traduzir]
    79. Set-Cookie
    80. Set-Cookie2 [Traduzir]
    81. SourceMap
    82. Strict-Transport-Security
    83. TE [Traduzir]
    84. Timing-Allow-Origin [Traduzir]
    85. Tk [Traduzir]
    86. Trailer [Traduzir]
    87. Transfer-Encoding [Traduzir]
    88. Upgrade-Insecure-Requests
    89. User-Agent
    90. Vary [Traduzir]
    91. Via [Traduzir]
    92. WWW-Authenticate
    93. Want-Digest [Traduzir]
    94. Warning [Traduzir]
    95. X-Content-Type-Options
    96. X-DNS-Prefetch-Control
    97. X-Forwarded-For [Traduzir]
    98. X-Forwarded-Host [Traduzir]
    99. X-Forwarded-Proto [Traduzir]
    100. X-Frame-Options [Traduzir]
    101. X-XSS-Protection [Traduzir]
  19. HTTP request methods
    1. CONNECT
    2. DELETE
    3. GET
    4. HEAD
    5. OPTIONS
    6. PATCH
    7. POST
    8. PUT
    9. TRACE
  20. HTTP response status codes
    1. 100 Continue
    2. 101 Switching Protocols
    3. 103 Early Hints
    4. 200 OK
    5. 201 Created
    6. 202 Accepted
    7. 203 Non-Authoritative Information
    8. 204 No Content
    9. 205 Reset Content
    10. 206 Partial Content
    11. 300 Multiple Choices
    12. 301 Moved Permanently
    13. 302 Found
    14. 303 See Other
    15. 304 Not Modified
    16. 307 Redirecionamento temporário
    17. 308 Permanent Redirect
    18. 400 Bad Request
    19. 401 Unauthorized
    20. 402 Payment Required
    21. 403 Forbidden
    22. 404 Not Found
    23. 405 Method Not Allowed
    24. 406 Not Acceptable
    25. 407 Proxy Authentication Required
    26. 408 Request Timeout
    27. 409 Conflict
    28. 410 Gone
    29. 411 Length Required
    30. 412 Precondition Failed
    31. 413 Payload Too Large
    32. 414 URI Too Long
    33. 415 Unsupported Media Type
    34. 416 Range Not Satisfiable
    35. 417 Expectation Failed
    36. 418 I'm a teapot
    37. 422 Unprocessable Entity
    38. 425 Too Early
    39. 426 Upgrade Required
    40. 428 Precondition Required
    41. 429 Too Many Requests
    42. 431 Request Header Fields Too Large
    43. 451 Unavailable For Legal Reasons
    44. 500 Internal Server Error
    45. 501 Not Implemented
    46. 502 Bad Gateway
    47. 503 Service Unavailable
    48. 504 Gateway Timeout
    49. 505 HTTP Version Not Supported
    50. 506 Variant Also Negotiates
    51. 507 Insufficient Storage
    52. 508 Loop Detected
    53. 510 Not Extended
    54. 511 Network Authentication Required
  21. CSP directives
    1. CSP: base-uri [Traduzir]
    2. CSP: block-all-mixed-content [Traduzir]
    3. CSP: child-src [Traduzir]
    4. CSP: connect-src [Traduzir]
    5. CSP: default-src [Traduzir]
    6. CSP: font-src [Traduzir]
    7. CSP: form-action [Traduzir]
    8. CSP: frame-ancestors [Traduzir]
    9. CSP: frame-src [Traduzir]
    10. CSP: img-src [Traduzir]
    11. CSP: manifest-src [Traduzir]
    12. CSP: media-src [Traduzir]
    13. CSP: navigate-to [Traduzir]
    14. CSP: object-src [Traduzir]
    15. CSP: plugin-types [Traduzir]
    16. CSP: prefetch-src [Traduzir]
    17. CSP: referrer [Traduzir]
    18. CSP: report-to [Traduzir]
    19. CSP: report-uri [Traduzir]
    20. CSP: require-sri-for [Traduzir]
    21. CSP: sandbox [Traduzir]
    22. CSP: script-src [Traduzir]
    23. CSP: script-src-attr [Traduzir]
    24. CSP: script-src-elem [Traduzir]
    25. CSP: style-src [Traduzir]
    26. CSP: style-src-attr [Traduzir]
    27. CSP: style-src-elem [Traduzir]
    28. CSP: trusted-types [Traduzir]
    29. CSP: upgrade-insecure-requests [Traduzir]
    30. CSP: worker-src [Traduzir]
  22. CORS errors
    1. Reason: CORS disabled [Traduzir]
    2. Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz' [Traduzir]
    3. Reason: CORS header 'Access-Control-Allow-Origin' missing
    4. Reason: CORS header ‘Origin’ cannot be added [Traduzir]
    5. Reason: CORS preflight channel did not succeed [Traduzir]
    6. Razão: A requisição CORS não foi bem sucedida
    7. Reason: CORS request external redirect not allowed [Traduzir]
    8. Reason: CORS request not HTTP
    9. Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’ [Traduzir]
    10. Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’ [Traduzir]
    11. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed [Traduzir]
    12. Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’ [Traduzir]
    13. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ [Traduzir]
    14. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Methods’ [Traduzir]
    15. Reason: missing token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel [Traduzir]
  23. Feature-Policy directives
    1. Feature-Policy: accelerometer [Traduzir]
    2. Feature-Policy: ambient-light-sensor [Traduzir]
    3. Feature-Policy: autoplay [Traduzir]
    4. Feature-Policy: battery [Traduzir]
    5. Feature-Policy: camera [Traduzir]
    6. Feature-Policy: display-capture [Traduzir]
    7. Feature-Policy: document-domain [Traduzir]
    8. Feature-Policy: encrypted-media [Traduzir]
    9. Feature-Policy: fullscreen [Traduzir]
    10. Feature-Policy: geolocation [Traduzir]
    11. Feature-Policy: gyroscope [Traduzir]
    12. Feature-Policy: layout-animations [Traduzir]
    13. Feature-Policy: legacy-image-formats [Traduzir]
    14. Feature-Policy: magnetometer [Traduzir]
    15. Feature-Policy: microphone [Traduzir]
    16. Feature-Policy: midi [Traduzir]
    17. Feature-Policy: oversized-images [Traduzir]
    18. Feature-Policy: payment [Traduzir]
    19. Feature-Policy: picture-in-picture [Traduzir]
    20. Feature-Policy: publickey-credentials [Traduzir]
    21. Feature-Policy: sync-xhr [Traduzir]
    22. Feature-Policy: unoptimized-images [Traduzir]
    23. Feature-Policy: unsized-media [Traduzir]
    24. Feature-Policy: usb [Traduzir]
    25. Feature-Policy: vibrate [Traduzir]
    26. Feature-Policy: vr [Traduzir]
    27. Feature-Policy: wake-lock [Traduzir]
    28. Feature-Policy: xr [Traduzir]
    29. Feature-Policy: xr-spatial-tracking [Traduzir]