X-Content-Type-Options
The HTTP X-Content-Type-Options response header indicates that the MIME types advertised in the Content-Type headers should be respected and not changed.
The header allows you to avoid MIME type sniffing by specifying that the MIME types are deliberately configured.
Site security testers usually expect this header to be set.
Note:
The X-Content-Type-Options header only apply request-blocking due to nosniff for request destinations of "script" and "style".
However, it also enables Cross-Origin Read Blocking (CORB) protection for HTML, TXT, JSON and XML files (excluding SVG image/svg+xml).
| Header type | Response header |
|---|---|
| Forbidden header name | No |
Syntax
X-Content-Type-Options: nosniff
Directives
nosniff-
Blocks a request if the request destination is of type
styleand the MIME type is nottext/css, or of typescriptand the MIME type is not a JavaScript MIME type.
Specifications
| Specification |
|---|
| Fetch Standard # x-content-type-options-header |
Browser compatibility
BCD tables only load in the browser
See also
Content-Type- The original definition of X-Content-Type-Options by Microsoft.
- Use HTTP Observatory to test the security configuration of websites (including this header).
- Mitigating MIME Confusion Attacks in Firefox
- Cross-Origin Read Blocking (CORB)
- Google Docs CORB explainer