Glossary / X-Content-Type-Options

X-Content-Type-Options

X-Content-Type-Options is an HTTP header whose only value, nosniff, stops the browser from guessing a file's type against what the server declared. The browser trusts the Content-Type header, not the file's contents. This closes attacks where an innocent-looking file is served and then run as an executable script.

By default browsers do MIME sniffing: if a file's declared type looks wrong, they try to work out the real type from its bytes. Convenient, but risky. A file a user uploaded as an image might get executed as JavaScript if it contains code.

The nosniff value turns that guessing off. If the server says a file is text/plain or image/png, the browser treats it exactly that way, even if the bytes look like a script or HTML.

The header matters most for sites that accept user uploads or serve files from shared storage. There is only one value, nosniff, and no alternatives, so configuring it is simply on or off.

Example

X-Content-Type-Options: nosniff

Common mistakes

• Enabling nosniff while serving scripts or styles with the wrong Content-Type, so the browser now refuses to run them and the site breaks.
• Treating it as full XSS protection. It is one link in the chain; CSP and correct Content-Type headers do the heavy lifting.
• Writing values like X-Content-Type-Options: on. The only accepted value is nosniff; anything else is ignored.
• Forgetting to set correct Content-Type on the server and relying on sniffing, which is exactly what nosniff disables.

Related terms

• HSTS (Strict-Transport-Security) HSTS (Strict-Transport-Security)
• Content-Security-Policy (CSP) Content-Security-Policy (CSP)
• X-Frame-Options X-Frame-Options
• Referrer-Policy Referrer-Policy
• Permissions-Policy Permissions-Policy