Safety
X-Content-Type-Options nosniff vs MIME Sniffing
August 5, 2026
X-Content-Type-Options nosniff vs MIME sniffing is a one-line header decision with a content-type homework assignment. nosniff tells supporting browsers not to guess a different MIME type than the server declared. That reduces MIME-confusion bugs where a file served as text/plain is treated as script. The header does not fix APIs that send the wrong Content-Type. RoastMyOpsec's free header audit looks for exact nosniff on the primary document. It does not inject polyglot files or exploit sniffing.
The practical difference
MIME sniffing is a browser compatibility leftover: look at bytes, ignore the label. nosniff is the site saying 'believe the label.' User-uploaded content and 'download' endpoints are where sniffing used to hurt most.
A marketing homepage still wants nosniff. It is cheap, cacheable, and belongs next to HSTS and framing on the edge.
How to choose what to ship
Send X-Content-Type-Options: nosniff on HTML and on anything users can upload or download. Set Content-Type correctly: HTML is text/html, JSON is application/json, JS is a JavaScript type — not text/plain for app bundles.
| Response | Content-Type | nosniff | Takeaway |
|---|---|---|---|
| Marketing HTML | text/html; charset=utf-8 | Required | Edge default for all documents |
| JSON API | application/json | Required | Stops 'this JSON is actually HTML' surprises |
| User uploads | True type; never text/html for untrusted files | Required | Header plus correct type plus CSP |
| Wrong type + no nosniff | Browser may guess | Missing | This is the MIME-confusion miss |
When nosniff is not enough
Serving user HTML as text/html with nosniff is still XSS if that HTML runs. nosniff is not a content sanitizer. Pair uploads with storage that cannot execute and a CSP that does not need unsafe-inline.
APIs that declare text/html for error pages can still get framed or sniffed in old clients. Keep API errors as JSON.
Common mistakes
The first mistake is nosniff on / and not on /assets/*.
The second mistake is Content-Type: text/plain for JavaScript because a tutorial did.
The third mistake is treating nosniff as a substitute for CSP.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is missing nosniff a critical vulnerability?
- Usually a hardening miss, not a standalone CVE. It matters more on hosts that serve user files or mixed content types. Still ship it everywhere.
- Does nosniff replace a correct Content-Type?
- No. It tells the browser to trust the type you sent. Send the right type.
- How does RoastMyOpsec check nosniff?
- It reads X-Content-Type-Options on the primary document as part of the free header pack. Header read only.