What X-Content-Type-Options does
The X-Content-Type-Options header with the value “nosniff” stops the browser from guessing the type of a file. A harmless text file cannot turn into a script that runs.
How it works
Every response from a web server says in its Content-Type header what it is: text/html for a page, image/png for an image, text/javascript for a script. If that is missing or wrong, browsers look into the content and guess. This is called MIME sniffing.
It becomes dangerous when visitors may upload files. If an attacker uploads a file that looks like an image or text but contains script code, a guessing browser may run it as a script as soon as a page includes it.
With X-Content-Type-Options: nosniff the browser sticks to the declared type. A script or stylesheet whose Content-Type does not fit is not loaded.
What matters
- Only one valid value.
nosniffis the only one. Other values or typos have no effect. - Send it exactly once. If both the web server and the application set the header, it appears twice in the response. Send it from one place.
- For every response. It matters most for uploaded files and scripts, not just HTML pages.
- Correct types. With
nosnifftheContent-Typehas to be right, or scripts and stylesheets stop loading. Web servers ship with a list; you may need to add your own file extensions.
How to set it up
The header:
X-Content-Type-Options: nosniffIt belongs in the web server configuration so it covers every file, including images and uploads that never pass through the application.
Note for nginx: a location block with its own add_header lines does not inherit the outer ones.
On shared hosting this usually goes into .htaccess, on a CDN into a response header rule. Afterwards, check that all scripts and stylesheets still load.