CodePark/ questions / Security headers
START PRACTICINGPRACTICE
Frontend question · Frontend security › Security headers

What does X-Content-Type-Options: nosniff protect against?

The browser guessing a file's type from its content, for example running an uploaded text file as a script

Without nosniff, a browser may look at a file's content and guess its type, which is called MIME sniffing. So a file uploaded as text/plain could run as a script. With nosniff, the browser blocks a script or stylesheet whose Content-Type doesn't match.

"Attackers reading network traffic" is the tempting wrong answer, because of the word "sniff". HTTPS and HSTS handle that. Stopping other sites from embedding your files is a job for Cross-Origin-Resource-Policy.