flawopen.com/XSS/Content-type sniffing
Content-Type sniffing XSS: how MIME confusion reaches the browser
A browser uses a response's Content-Type to decide how to handle its bytes. If an application serves attacker-controlled files with missing or incorrect types, MIME sniffing can make some responses act differently than intended. Send the correct type and X-Content-Type-Options: nosniff, and isolate user uploads from the application's origin. The header reduces one browser interpretation risk; it does not sanitize files or replace upload controls.
How an upload can cross the document boundary
Suppose an application accepts user uploads and later serves them from its own authenticated origin with a missing or mismatched Content-Type. If a browser interprets a response as an HTML document, markup in that file can become active in the site's origin. That creates a stored XSS or content-confusion risk when victims open the file. The extension and the upload request's claimed media type are not reliable proof of the bytes' format.
Set the type deliberately and isolate downloads
HTTP/1.1 200 OK Content-Type: application/octet-stream // no X-Content-Type-Options // same origin as the authenticated application
HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="download.txt"
Use a server-selected Content-Type that matches the bytes you intend to serve; do not copy the uploader's claimed type. X-Content-Type-Options: nosniff disables MIME sniffing for document responses and blocks script or stylesheet requests whose MIME type is wrong. It is not a universal XSS fix: keep uploads on a separate origin, prefer Content-Disposition: attachment for downloads, and enforce size, authorization, and file-validation rules. For images or other inline media, return the verified media type and test the actual browser response path.
FAQ
No. It controls browser MIME interpretation and script/style request checks, but it does not validate or sanitize a file, make an incorrect Content-Type correct, or isolate a same-origin upload. Use a separate origin and attachment downloads for untrusted files.
References
- MDN — X-Content-Type-Options response header
- WHATWG Fetch Standard — X-Content-Type-Options
- OWASP — HTTP Security Response Headers Cheat Sheet