X-Content-Type-Options

{{HTTPSidebar}} 

The HTTP X-Content-Type-Options {{Glossary("response header")}}  indicates that the MIME types advertised in the {{HTTPHeader("Content-Type")}}  headers should be respected and not changed. The header allows you to avoid MIME type sniffing by specifying that the MIME types are deliberately configured.

Site security testers usually expect this header to be set.

[!NOTE] The X-Content-Type-Options header only apply request-blocking due to nosniff for request destinations of "script" and "style". However, it also enables Cross-Origin Read Blocking (CORB) protection for HTML, TXT, JSON and XML files (excluding SVG image/svg+xml).

Syntax

X-Content-Type-Options: nosniff

Directives

• nosniff
  • : Blocks a request if the request destination is of type style and the MIME type is not text/css, or of type script and the MIME type is not a JavaScript MIME type.

Specifications

{{Specifications}} 

Browser compatibility

{{Compat}} 

See also

• {{HTTPHeader("Content-Type")}} 
• The original definition of X-Content-Type-Options by Microsoft.
• Use HTTP Observatory to test the security configuration of websites (including this header).
• Mitigating MIME Confusion Attacks in Firefox
• Cross-Origin Read Blocking (CORB)
• Google Docs CORB explainer