How to disable MIME sniffing?

mime-sniffing-enabled global

The issue

When a browser guesses a response’s type from its content instead of trusting Content-Type, a file uploaded as harmless text or an image can end up treated as something it wasn’t declared to be. The X-Content-Type-Options: nosniff header turns that guessing off.

The cause is browser history. Servers once sent missing or wrong types, so browsers learned to sniff. With nosniff, browsers refuse to run a script or apply a stylesheet whose declared type doesn’t match.

Scope

The header belongs on every response: pages, scripts, stylesheets, images and files users upload. Probeo checks that it is present on each response it fetches.

How to check you have it

• In probeo: a response without the header is recorded as x-content-type-options-missing.
• By hand: run curl -sI https://example.com/ and look for x-content-type-options: nosniff. Repeat for a script, a stylesheet and an uploaded file.

FAQ

Why do browsers perform MIME sniffing?

Historical compatibility. Early web servers often sent incorrect Content-Type headers or generic application/octet-stream for all files. Browsers sniffed content to render pages correctly despite server misconfiguration. This behavior became entrenched. Legacy sites depend on it. Modern sites should declare types accurately and disable sniffing. The security cost of sniffing outweighs compatibility benefits.

What breaks when MIME sniffing is disabled?

Content served with incorrect Content-Type headers fails to render correctly. A JavaScript file served as text/plain will not execute. An HTML file served as text/plain displays as text. These are usually configuration errors that should be fixed regardless. Legitimate content with correct Content-Type declarations works fine. Fixing misconfigured types is the correct response not allowing sniffing.

How do content-type confusion attacks work?

An attacker uploads a file whose content is not what its declared type says, then gets a browser to use it in a context the site never intended, such as loading it as a script. Without nosniff, the browser may go by the content. With it, a script or stylesheet whose declared type doesn’t match is refused.

Does nosniff affect video and audio content?

Its strict blocking applies to scripts and stylesheets. Media should still be served with accurate types, such as video/mp4 or audio/mpeg, and the header does no harm on those responses.

Can nosniff be set for specific responses or must it be global?

It can be set per response but should be global. The header has no negative effects when applied universally. Setting it selectively risks missing responses that need protection. User-uploaded files especially require the header. These often reside in different paths or storage systems. Global application through web server or CDN configuration ensures complete coverage.

What if the CDN or proxy removes the header?

Configure the CDN to preserve or add X-Content-Type-Options. Most CDNs allow header manipulation. Set the CDN to add the header if not present or preserve it if present in origin responses. Test CDN behavior by inspecting headers on delivered responses not just origin responses. Some CDNs have security header policies that can add nosniff automatically.