3

X-Content-Type-Options helps to protect against attacks that take advantage of the browser trying to interpret HTTP responses with an incorrectly stated Content-Type.

But what happens when the HTTP response sets the X-Content-Type-Options header but not the Content-Type header.

Will the browser still "sniff" or will it take a certain default?

6
  • According to Mozilla, nosniff only applies to "script" and "style" types therefore it shouldn't have any effect when no content type is specified - the browser can still sniff. Internet Explorer/Edge seems most vulnerable to script tags being embedded in responses without a content types se. Oct 6 '17 at 9:36
  • I dont enterily understand. Can you elaborate in an answer?
    – Silver
    Oct 9 '17 at 9:00
  • According to the link I posted, nosniff only affects script and style content types. In the case of no content type then Internet Explorer will sniff and read script tags and execute them. Oct 9 '17 at 9:05
  • Indeed, seems to be a Firefox and Chrome implementation github.com/whatwg/fetch/issues/395 But they also mention that this is not following the specs.
    – Silver
    Oct 9 '17 at 9:16
  • Exactly. Before reading the Mozilla link I would have pointed you in this direction: blog.fox-it.com/2012/05/08/… / msdn.microsoft.com/library/ms775147(v=vs.85).aspx Oct 9 '17 at 9:27
1

Found the answer on the same page:

  1. Let mimeType be the result of extracting a MIME type from response’s header list.
  2. Let destination be request’s destination.
  3. If destination is script-like and mimeType (ignoring parameters) is not a JavaScript MIME type, then return blocked.
  4. If destination is "style" and mimeType (ignoring parameters) is not text/css, then return blocked.
  5. Return allowed.

I assume, since there is no MIME type declared, step 3 never returns blocked. In my case, there is no destination either, so we finish in step 5 -> allowed.

Edit: In step 3 and 4 an empty mime-type will not be a javascript mime type or a text/css mime-type. Therefor the request will be blocked if the destination matches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.