Security Test: X-Content-Type-Options¶

Scanner(s) Support¶

Description¶

Default Severity: low

If this header isn't set or is set incorrectly, browsers might guess the file's type instead of strictly following what's declared. This uncertainty can let some browsers mistakenly show code or media in a way that attackers could exploit, such as tricking them into downloading malicious files. Developers need to handle this carefully because relying on MIME-sniffing can lead to unexpected behavior and security issues. It's a simple fix that goes a long way in preventing content type confusion in browsers that still perform their own guessing.

Configuration¶

Identifier: protocol/header_x_content_type_options

Examples¶

All configuration available:

checks:
  protocol/header_x_content_type_options:
    skip: false # default

Compliance and Standards¶