How to disable MIME sniffing?

mime-sniffing-enabledglobal

MIME sniffing is browser behavior that attempts to determine content type by examining file contents rather than trusting the Content-Type header. Browsers inspect byte patterns to detect HTML, scripts, images, and other formats. This override creates security vulnerabilities when user-uploaded content or untrusted sources serve files with incorrect Content-Type headers. The X-Content-Type-Options header with nosniff value disables this behavior. Browsers then respect declared Content-Type headers without inspection or override.

What’s wrong

The response lacks an X-Content-Type-Options header or has a value other than nosniff. Browsers perform MIME sniffing by default when this header is absent. The browser examines response bytes looking for signatures like angle brackets indicating HTML or script keywords suggesting JavaScript. If the browser detects these patterns, it may execute content as HTML or script regardless of the declared Content-Type. An image/png response containing HTML tags may render as HTML. A text/plain response with JavaScript syntax may execute as code.

Why it matters

MIME sniffing enables content-type confusion attacks. Attackers upload files with malicious content disguised as safe file types. A file uploaded as an image with Content-Type image/png might contain HTML with JavaScript. Without nosniff, browsers detect the HTML and execute the JavaScript. This bypasses upload restrictions and content filtering. Sites often validate file extensions and set Content-Type based on extension. This provides no protection if browsers ignore the header. User-generated content becomes an XSS vector. The X-Content-Type-Options nosniff header forces browsers to respect declared types without inspection.

The correct change

Add the X-Content-Type-Options header with value nosniff to all HTTP responses. Configure the web server or application framework to include this header globally. Verify that Content-Type headers accurately reflect actual content types. Mismatches between declared and actual types cause failures when MIME sniffing is disabled. HTML files must declare text/html. JavaScript files must declare application/javascript or text/javascript. CSS files must declare text/css. Images must declare appropriate image types. The end state is X-Content-Type-Options: nosniff on all responses and accurate Content-Type declarations.

Scope

This condition applies globally across all HTTP responses. The header should appear on HTML pages, scripts, stylesheets, images, fonts, and all other resources. Some frameworks apply headers to HTML responses only. MIME sniffing risks apply to all content types especially user-uploaded files. Static file servers must include the header. CDN configurations should add the header if not present in origin responses. Dynamic and static content paths both require protection.

How to verify

• Validation confirms the condition is resolved:
• • All HTTP responses include X-Content-Type-Options: nosniff header
• • HTML pages include the header
• • JavaScript and CSS resources include the header
• • Image and font files include the header
• • User-uploaded files include the header
• • Content-Type headers accurately match actual content
• • Browser treats content according to declared types without sniffing

Takeaway

• MIME sniffing allows browsers to override Content-Type headers by examining file contents
• This behavior enables content-type confusion attacks against user-uploaded files
• X-Content-Type-Options: nosniff forces browsers to respect declared content types
• The header must appear on all responses not just HTML pages
• Accurate Content-Type declarations are required when MIME sniffing is disabled

FAQ

Why do browsers perform MIME sniffing?

Historical compatibility. Early web servers often sent incorrect Content-Type headers or generic application/octet-stream for all files. Browsers sniffed content to render pages correctly despite server misconfiguration. This behavior became entrenched. Legacy sites depend on it. Modern sites should declare types accurately and disable sniffing. The security cost of sniffing outweighs compatibility benefits.

What breaks when MIME sniffing is disabled?

Content served with incorrect Content-Type headers fails to render correctly. A JavaScript file served as text/plain will not execute. An HTML file served as text/plain displays as text. These are usually configuration errors that should be fixed regardless. Legitimate content with correct Content-Type declarations works fine. Fixing misconfigured types is the correct response not allowing sniffing.

How do content-type confusion attacks work?

Attacker uploads a file to a vulnerable site. The file contains malicious HTML and JavaScript but has a .png extension. The site stores the file and serves it with Content-Type image/png. Without nosniff, browsers sniff the content, detect HTML, and render it. The JavaScript executes in the site’s origin. This bypasses upload validation. The X-Content-Type-Options nosniff header prevents the browser from ignoring the image/png declaration.

Does nosniff affect video and audio content?

Yes. Video and audio files must have correct Content-Type headers like video/mp4 or audio/mpeg. Browsers will not play media with incorrect types when nosniff is set. This prevents media files from being interpreted as scripts or HTML. User-uploaded media should be validated and served with appropriate types. The security benefit applies to all content types.

Can nosniff be set for specific responses or must it be global?

It can be set per response but should be global. The header has no negative effects when applied universally. Setting it selectively risks missing responses that need protection. User-uploaded files especially require the header. These often reside in different paths or storage systems. Global application through web server or CDN configuration ensures complete coverage.

What if the CDN or proxy removes the header?

Configure the CDN to preserve or add X-Content-Type-Options. Most CDNs allow header manipulation. Set the CDN to add the header if not present or preserve it if present in origin responses. Test CDN behavior by inspecting headers on delivered responses not just origin responses. Some CDNs have security header policies that can add nosniff automatically.

The fix

Prevent content-type confusion attacks by disabling browser MIME sniffing

Done when: All HTTP responses include X-Content-Type-Options: nosniff and accurate Content-Type headers

Do not

• Do not rely on file extensions for content type security
• Do not serve user-uploaded files without nosniff header
• Do not use generic application/octet-stream Content-Type
• Do not apply nosniff selectively to only some responses

How to verify

• X-Content-Type-Options: nosniff present on all responses
• Content-Type headers accurately match actual content
• User-uploaded files include the header
• Browser respects declared types without sniffing
• No content-type mismatches break functionality

Find every page with this

probeo monitors this continuously across every page of your site, and records which pages passed, which failed, and which it could not determine.