HTTP security header

X-Content-Type-Options

Setting X-Content-Type-Options: nosniff prevents browsers from guessing (sniffing) a response's content type, forcing them to honor the declared Content-Type. This blocks attacks where a file served as one type is interpreted as executable script, a common vector for stored-XSS via uploads.

Example

X-Content-Type-Options: nosniff

Configuration guidance

Send nosniff on all responses, especially user-uploaded content.
Pair with correct, explicit Content-Type headers.

Helps mitigate

Cross-Site Scripting (XSS)

Related headers

Content-Security-Policy
Content-Disposition

MDN: X-Content-Type-Options

Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.

Start an engagement

← All security headers