Skip to main content
protocols.pageprotocols.page

X-Content-Type-Options

SecurityActive

The X-Content-Type-Options header with value 'nosniff' prevents browsers from MIME-type sniffing – guessing the content type from the response body instead of using the declared Content-Type. MIME sniffing can allow attackers to serve malicious content disguised as benign files.

X-Content-Type-Options: nosniff

Description

X-Content-Type-Options: nosniff prevents browsers from interpreting files as a different MIME type than declared. Without this header, browsers may 'sniff' the content and execute a JavaScript file served as text/plain, or display a HTML file served as text/csv. This header has only one valid value: nosniff.

Examples

Standard usage
http
X-Content-Type-Options: nosniff

Related

Content-Type

Specification

WHATWG Fetch Standard – X-Content-Type-Options specification →