I have read about X-Content-Type-Options and it says often that it protects against IE mime sniffing problems.

I am wondering if in 2021 it is still valid and a problem for modern browsers? In other words, will it be beneficial for my web server that serves html, images, etc. to have this header on?

  • 1
    Sadly, even in 2021, there are still a non-trivial number of people who are not using modern browsers - especially in areas like big enterprises, healthcare and government.
    – Gh0stFish
    Oct 22, 2021 at 13:14
  • 1
    Yes, that is definitely the case, but lets say it's their fault if they do. So I am wondering if those who do use modern browsers are protected by default of not nowadays? Oct 23, 2021 at 16:47

2 Answers 2


The MIME type indicates the file format. HTTP responses can contain a Content-Type header that indicates the MIME type. On top of that, browsers try to determine the MIME type based on the response data. E.g. if it starts with <html>, it is probably HTML.

IE7 used to render responses as HTML if they looked like HTML, even when the Content-Type header indicated it was not HTML, e.g. text/plain. This resulted in security issues. If an attacker could inject <script>alert(1) in a text response, this would be rendered as HTML and JavaScript would be executed, even if it would be rendered as plaintext before the attacker injected their content.

This kind of insecure behavior is no longer present in modern browsers. First, they take the Content-Type header pretty seriously. When in doubt, they avoid interpreting content as dangerous. So when the Content-Type header says text/plain but the content looks like HTML, they render it is plaintext because that is the more secure thing to do.

When there is no Content-Type response header, however, sniffing determines how the response is rendered. A response without a Content-Type header that looks like HTML gets rendered as HTML. This can be a security risk, and here X-Content-Type-Options: nosniff can help. With nosniff, a page that looks like HTML gets rendered as plain text. Of course, setting a Content-Type header would also help.

Content sniffing is also performed when loading scripts and styles. Normally, when a page contains <script src="script.js"></script>, the file script.js is loaded, even if it does not have the correct Content-Type response header. With nosniff, the script is not loaded. This behavior is actually specified in the Fetch Standard.

This in turn makes it possible for Cross Origin Read Blocking (CORB) to be stricter in blocking cross-origin JavaScript requests. CORB is meant to block certain cross-origin responses. When specifying nosniff, more responses can be reliably blocked.

Finally, some modern web specifications such as Signed Exchanges only work when nosniff is included in the response headers.

So, even though XSS through MIME type sniffing is pretty rare, the X-Content-Type-Options header is alive and well. It is still useful for responses without Content-Type header, and to enable stricter security behavior of the browser.


Hmm, I ve got the same worry about MIME sniffing nowadays. I tested Edge/Chrome/Firefox & Opera and it seems that 'modern' browsers don't use 'sniffing' anymore : if I set 'nosniff' option or not on the web server and I rename html file into jpg file, these browser always tries to display an image. If browser uses the 'sniffing', it should have displayed an html page. If user still uses 'old' browser, it may has potentially others security issues. (it is like to not update its antivirus app).

  • 1
    Sniffing has less to do with the extension than the Content-Type response header. Were you sending that at all? If so, what value(s) were you using, and were you editing it when you changed the extension?
    – CBHacking
    Sep 10, 2022 at 1:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .