X-Content-Type-Options helps to protect against attacks that take advantage of the browser trying to interpret HTTP responses with an incorrectly stated Content-Type.

But what happens when the HTTP response sets the X-Content-Type-Options header but not the Content-Type header.

Will the browser still "sniff" or will it take a certain default?

  • According to Mozilla, nosniff only applies to "script" and "style" types therefore it shouldn't have any effect when no content type is specified - the browser can still sniff. Internet Explorer/Edge seems most vulnerable to script tags being embedded in responses without a content types se. Oct 6, 2017 at 9:36
  • I dont enterily understand. Can you elaborate in an answer?
    – Silver
    Oct 9, 2017 at 9:00
  • According to the link I posted, nosniff only affects script and style content types. In the case of no content type then Internet Explorer will sniff and read script tags and execute them. Oct 9, 2017 at 9:05
  • Indeed, seems to be a Firefox and Chrome implementation github.com/whatwg/fetch/issues/395 But they also mention that this is not following the specs.
    – Silver
    Oct 9, 2017 at 9:16
  • Exactly. Before reading the Mozilla link I would have pointed you in this direction: blog.fox-it.com/2012/05/08/… / msdn.microsoft.com/library/ms775147(v=vs.85).aspx Oct 9, 2017 at 9:27

1 Answer 1


Found the answer on the same page:

  1. Let mimeType be the result of extracting a MIME type from response’s header list.
  2. Let destination be request’s destination.
  3. If destination is script-like and mimeType (ignoring parameters) is not a JavaScript MIME type, then return blocked.
  4. If destination is "style" and mimeType (ignoring parameters) is not text/css, then return blocked.
  5. Return allowed.

I assume, since there is no MIME type declared, step 3 never returns blocked. In my case, there is no destination either, so we finish in step 5 -> allowed.

Edit: In step 3 and 4 an empty mime-type will not be a javascript mime type or a text/css mime-type. Therefor the request will be blocked if the destination matches.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .