X-Content-Type-Options headers to secure your site

The HTTP header X-Content-Type-OptionsX-Content-Type-Options is a security feature that prevents MIME types from being sniffed and misinterpreted by browsers. This is crucial in blocking certain types of attacks such as MIME type confusion, where an attacker can manipulate the MIME type of a transmitted file to cause a browser to interpret it differently than intended.

Header Options

The X-Content-Type-Options header has only one directive: nosniff. When this directive is used, it instructs the browser to adhere strictly to the MIME types advertised in the Content-Type headers and not attempt to guess the MIME type, which can lead to security vulnerabilities.

Browser Compatibility

The X-Content-Type-Options: nosniff is well-supported across all modern browsers. For Chrome, this header has been supported since version 1. Implementing this header can enhance security by ensuring that stylesheets and scripts are not executed if the MIME type is not correctly declared.

Configuring X-Content-Type-Options on Common Web Servers

1. Apache Web Server

To configure Apache to send the X-Content-Type-Options header, add the following line to your Apache configuration file or .htaccess file:apache

Header set X-Content-Type-Options "nosniff"

This line ensures that the nosniff option is set on all responses from the server.

2. Nginx

For Nginx, add the following directive to your server configuration:

add_header X-Content-Type-Options "nosniff" always;

The always parameter ensures that the header is included in all responses, including those with 4XX status codes.

3. IIS (Internet Information Services)

To add the header in IIS, you can use the GUI or edit the web.config file:

• 3.1 GUI Method:
  1. Open IIS Manager.
  2. Go to HTTP Response Headers for your site.
  3. Click on “Add” in the actions sidebar.
  4. Set the name to X-Content-Type-Options and the value to nosniff.
• 3.2 Web.config Method:
  • Add the following inside the <system.webServer> section of your web.config file :

<httpProtocol>
  <customHeaders>
    <add name="X-Content-Type-Options" value="nosniff" />
  </customHeaders>
</httpProtocol>

Implementing the X-Content-Type-Options: nosniff header is a straightforward and effective measure to enhance the security of a website. By configuring it on your web servers, you can prevent MIME type sniffing attacks and ensure that the content served is executed as intended by the server, not as inferred by the client. As security threats evolve, employing such headers is an essential step in safeguarding your web applications. Test your security headers configurations with our free headers.doctor tool.