Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In order to prevent Cross-site scripting (XSS) in a private web application that supports image upload, I intend to reject browsers that are vulnerable to content sniffing.
Which browsers are currently vulnerable to this exploit?
PS. I'm aware of the X-Content-Type-Options header, which isn't fully supported as far as I know.
If you don't send a content-type header most browsers will do content sniffing. If you do send a content-type header as far as I know all versions of internet explorer will do sniffing unless x-content-type-options: nosniff is set. IE should accept this header starting with IE8 (blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx).
Just an idea: you might try to detect if the browser is vulnerable to content-type sniffing by serving an HTML page with an redirect as content-type: text/plain. If you the browser gets redirected it is vulnerable (you might also check the effectiveness of the nosniff option this way). If you just include this test-page into a small and maybe invisible iframe you can do the check without affecting the rest of the website.
<html><head><meta http-equiv="refresh" content="5; url=http://example.com/vulnerable.html"></head></html>. Serve without content-type. Only if the browser interprets this as HTML it will issue the redirect.
Aug 1, 2017 at 15:58