X-Content-Type-Options without content-type

Question

X-Content-Type-Options helps to protect against attacks that take advantage of the browser trying to interpret HTTP responses with an incorrectly stated Content-Type.

But what happens when the HTTP response sets the X-Content-Type-Options header but not the Content-Type header.

Will the browser still "sniff" or will it take a certain default?

Answer 1

Found the answer on the same page:

1. Let mimeType be the result of extracting a MIME type from response’s header list.
2. Let destination be request’s destination.
3. If destination is script-like and mimeType (ignoring parameters) is not a JavaScript MIME type, then return blocked.
4. If destination is "style" and mimeType (ignoring parameters) is not text/css, then return blocked.
5. Return allowed.

I assume, since there is no MIME type declared, step 3 never returns blocked. In my case, there is no destination either, so we finish in step 5 -> allowed.

Edit: In step 3 and 4 an empty mime-type will not be a javascript mime type or a text/css mime-type. Therefor the request will be blocked if the destination matches.