The X-Content-Type-Options
response HTTP header is a marker used by the server to indicate that the MIME types advertised in the {{HTTPHeader("Content-Type")}} headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.
This is header that was introduced by Microsoft in IE 8 as a way for the webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.
Site security testers usually expect this header to be set.
Header type | {{Glossary("Response header")}} |
---|---|
{{Glossary("Forbidden header name")}} | no |
Syntax
X-Content-Type-Options: nosniff
Directives
nosniff
- Do not perform any MIME sniffing. Apply the MIME type given with {{HTTPHeader("Content-Type")}}.
Specifications
Specification | Status | Comment |
---|---|---|
{{SpecName("Fetch", "#x-content-type-options-header", "X-Content-Type-Options definition")}} | {{Spec2("Fetch")}} | Initial definition |
Browser compatibility
The compatibility table in this page is generated from structured data. If you’d like to contribute to the data, please check out https://github.com/mdn/browser-compat-data/README.md and send us a pull request.
{{Compat}}
See also
- {{HTTPHeader("Content-Type")}}
- The original definition of X-Content-Type-Options by Microsoft.
- The Mozilla Observatory tool testing the configuration (including this header) of Web sites for safety and security