Agent WranglersAPS-27Recommended
Stop browsers guessing file types
Send X-Content-Type-Options: nosniff on every response, so browsers don't guess file types. Give every response its correct Content-Type.
How to do it
Add the header in middleware that runs for every response. Map every file extension to its correct type. Test it with the attack in Send the security headers as one set.
Examples
HTTP example
HTTP/2 200
content-type: text/css; charset=utf-8
x-content-type-options: nosniffHow to check
curl -sI on HTML, CSS, JS, JSON and images shows nosniff and the right type.
Sources
Related rules
- MED-3 Serve user files from their own domain in Files and media
- APS-100 Send the security headers as one set in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/x-content-type-options">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.