In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing.

Which browsers are currently vulnerable to this exploit?

PS. I'm aware of the X-Content-Type-Options header, which isn't fully supported as far as I know.

1 Answer 1


If you don't send a content-type header most browsers will do content sniffing. If you do send a content-type header as far as I know all versions of internet explorer will do sniffing unless x-content-type-options: nosniff is set. IE should accept this header starting with IE8 (blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx).

Just an idea: you might try to detect if the browser is vulnerable to content-type sniffing by serving an HTML page with an redirect as content-type: text/plain. If you the browser gets redirected it is vulnerable (you might also check the effectiveness of the nosniff option this way). If you just include this test-page into a small and maybe invisible iframe you can do the check without affecting the rest of the website.

  • Hmm capability testing is a nice approach, I think it would work with single page js applications, so I could check whether the browser is vulnerable to content sniffing and prevent the inclusion of images if necessary... I will combine this with a server side image resizer, that should do the trick.
    – inf3rno
    May 9, 2014 at 14:26
  • @Staffen Ullrich: How to test browser is vulnerable with simple HTML page? I didn't quiet get that. Can you post an example please?
    – ParagJ
    Aug 1, 2017 at 11:06
  • @ParagJ: <html><head><meta http-equiv="refresh" content="5; url=http://example.com/vulnerable.html"></head></html>. Serve without content-type. Only if the browser interprets this as HTML it will issue the redirect. Aug 1, 2017 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .