X-Content-Type-Options.

Stops browsers from guessing file types — prevents MIME-sniffing attacks

What does this check test?

The `X-Content-Type-Options` header with the value `nosniff` instructs browsers to strictly follow the `Content-Type` header and never attempt to infer the MIME type of a response by examining its content. Without this header, browsers may 'sniff' the content and interpret a file differently than intended — for example, treating a plain text file as executable JavaScript if it contains script-like content.

Why does it matter?

MIME-sniffing attacks exploit the gap between a file's declared content type and what the browser decides to treat it as. An attacker could upload a file with a `.txt` extension containing JavaScript, and if the server serves it with `Content-Type: text/plain` but without `X-Content-Type-Options: nosniff`, the browser might execute it as a script in certain contexts. This is a well-known attack vector in user file upload scenarios and can lead to stored XSS.

Who is affected?

This header is essential for any site that serves user-uploaded content, API responses, or mixed content types. Applications with file upload features (profile images, document attachments, etc.) are especially vulnerable without it. Since the header has zero negative side effects and is trivial to deploy, every web application should include it regardless of whether it handles user uploads.

Where does this apply?

Set `X-Content-Type-Options: nosniff` on all HTTP responses, not just HTML pages. It is especially important on responses serving JavaScript, CSS, and user-uploaded files. Configure it at the server level (Nginx, Apache), CDN, or application middleware so it applies globally.

How to fix it

add_header X-Content-Type-Options "nosniff" always;

Header always set X-Content-Type-Options "nosniff"

app.use(helmet.noSniff());

SECURE_CONTENT_TYPE_NOSNIFF = True  # default is True

@app.after_request
def set_headers(response):
    response.headers['X-Content-Type-Options'] = 'nosniff'
    return response

module.exports = {
  async headers() {
    return [{
      source: '/(.*)',
      headers: [{ key: 'X-Content-Type-Options', value: 'nosniff' }]
    }];
  }
};

http.headers().contentTypeOptions(); // enabled by default

References

• MDN: X-Content-Type-Options
• OWASP: MIME Sniffing
• Fetch Standard: X-Content-Type-Options