Please note, this is a STATIC archive of website developer.mozilla.org from 03 Nov 2016, cach3.com does not collect or store any user information, there is no "phishing" involved.

X-Content-Type-Options

我们的志愿者还没有将这篇文章翻译为 中文 (简体)加入我们帮助完成翻译!

The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a way to say that the webmasters knew what they were doing.

This header was introduced by Microsoft in IE 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.

Site security testers usually expect this header to be set.

Header type Response header
Forbidden header name no

Syntax

X-Content-Type-Options: nosniff

Directives

nosniff
Do not perform any MIME sniffing. Apply the MIME type given with Content-Type.

Specifications

Specification Status Comment
Fetch
The definition of 'X-Content-Type-Options definition' in that specification.
Living Standard Initial definition

Browser compatibility

Feature Chrome Edge Firefox Internet Explorer Opera Safari Servo
Basic Support1.0(Yes)518.013No support(Yes)
Feature Android Chrome for Android Edge Mobile Firefox for Android IE Mobile Opera Mobile Safari Mobile
Basic Support(Yes)(Yes)(Yes)51(Yes)(Yes)No support

See also

文档标签和贡献者

 此页面的贡献者: WhatIsHeDoing, fscholz, teoli
 最后编辑者: WhatIsHeDoing,