X-Content-Type-Options

The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.

This header was introduced by Microsoft in IE 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.

Starting with Firefox 72, the opting out of MIME sniffing is also applied to top-level documents if a Content-type is provided. This can cause HTML web pages to be downloaded instead of being rendered when they are served with a MIME type other than text/html. Make sure to set both headers correctly.

Site security testers usually expect this header to be set.

Note: X-Content-Type-Options only apply request-blocking due to nosniff for request destinations of "script" and "style". However, it also enables Cross-Origin Read Blocking (CORB) for HTML, TXT, JSON and XML files (excluding SVG image/svg+xml).

Header type Response header
Forbidden header name no

Syntax

X-Content-Type-Options: nosniff

Directives

nosniff

Blocks a request if the request destination is of type
  • "style" and the MIME type is not text/css, or
  • "script" and the MIME type is not a JavaScript MIME type
Enables Cross-Origin Read Blocking for the MIME-types
  • text/html
  • text/plain
  • text/json, application/json or any other type with a JSON extension: */*+json
  • text/xml, application/xml or any other type with an XML extension: */*+xml (excluding image/svg+xml)

Specifications

Specification Status Comment
Fetch
The definition of 'X-Content-Type-Options definition' in that specification.
Living Standard Initial definition

Browser compatibility

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
X-Content-Type-Options
Non-standard
Chrome Full support 64
Full support 64
Partial support 1
Notes
Notes Not supported for stylesheets.
Edge Full support 12Firefox Full support 50IE Full support 8Opera Full support YesSafari No support NoWebView Android Full support 64
Full support 64
Partial support Partial
Notes
Notes Not supported for stylesheets.
Chrome Android Full support 64
Full support 64
Partial support Partial
Notes
Notes Not supported for stylesheets.
Firefox Android Full support 50Opera Android Full support YesSafari iOS No support NoSamsung Internet Android Full support 9.0
Full support 9.0
Partial support Partial
Notes
Notes Not supported for stylesheets.

Legend

Full support  
Full support
No support  
No support
Non-standard. Expect poor cross-browser support.
Non-standard. Expect poor cross-browser support.
See implementation notes.
See implementation notes.

Browser specific notes

  • Firefox 72 enables X-Content-Type-Options: nosniff for top-level documents

See also