The X-Content-Type-Options
response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type
headers should not be changed and be followed. This is a way to opt out of MIME type sniffing, or, in other words, to say that the MIME types are deliberately configured.
This header was introduced by Microsoft in IE 8 as a way for webmasters to block content sniffing that was happening and could transform non-executable MIME types into executable MIME types. Since then, other browsers have introduced it, even if their MIME sniffing algorithms were less aggressive.
Starting with Firefox 72, the opting out of MIME sniffing is also applied to top-level documents if a Content-type
is provided. This can cause HTML web pages to be downloaded instead of being rendered when they are served with a MIME type other than text/html
. Make sure to set both headers correctly.
Site security testers usually expect this header to be set.
Note: X-Content-Type-Options
only apply request-blocking due to nosniff
for request destinations of "script
" and "style
". However, it also enables Cross-Origin Read Blocking (CORB) protection for HTML, TXT, JSON and XML files (excluding SVG image/svg+xml
).
Header type | Response header |
---|---|
Forbidden header name | no |
Syntax
X-Content-Type-Options: nosniff
Directives
nosniff
- Blocks a request if the request destination is of type:
- "
style
" and the MIME type is nottext/css
, or - "
script
" and the MIME type is not a JavaScript MIME type
- "
- Enables Cross-Origin Read Blocking (CORB) protection for the MIME-types:
text/html
text/plain
text/json
,application/json
or any other type with a JSON extension:*/*+json
text/xml
,application/xml
or any other type with an XML extension:*/*+xml
(excludingimage/svg+xml
)
Specifications
Specification | Status | Comment |
---|---|---|
Fetch The definition of 'X-Content-Type-Options definition' in that specification. |
Living Standard | Initial definition |
Browser compatibility
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
X-Content-Type-Options | Chrome
Full support
64
| Edge Full support 12 | Firefox Full support 50 | IE Full support 8 | Opera Full support Yes | Safari Full support 11 | WebView Android
Full support
64
| Chrome Android
Full support
64
| Firefox Android Full support 50 | Opera Android Full support Yes | Safari iOS Full support 11 | Samsung Internet Android
Full support
9.0
|
Legend
- Full support
- Full support
- See implementation notes.
- See implementation notes.
Browser specific notes
- Firefox 72 enables
X-Content-Type-Options: nosniff
for top-level documents
See also
Content-Type
- The original definition of X-Content-Type-Options by Microsoft.
- The Mozilla Observatory tool testing the configuration (including this header) of Web sites for safety and security
- Mitigating MIME Confusion Attacks in Firefox
- Cross-Origin Read Blocking (CORB)
- Google Docs CORB explainer