Beginner LevelWeb Security & Cyber Defense
What is MIME Sniffing and why should you set X-Content-Type-Options: nosniff?
❓ Interview Prompt: Explain MIME Sniffing, browser payload inspection, executing text/images as JavaScript, and `X-Content-Type-Options: nosniff`.
MIME Sniffing occurs when a browser ignores the server's declared 'Content-Type' header and inspects payload bytes to guess the file format:
Exploit Risk:
If an attacker uploads an image file ('avatar.png') containing embedded JavaScript, and the server returns 'Content-Type: text/plain', browsers with MIME sniffing enabled might interpret the file as JavaScript and execute it!
•
Fix: Set 'X-Content-Type-Options: nosniff' header to force browsers to strictly honor the declared 'Content-Type'.
Code Implementation Example
http
HTTP/1.1 200 OK
Content-Type: image/jpeg
X-Content-Type-Options: nosniff💡Enforcing strict MIME types with X-Content-Type-Options nosniff header.
🎯 Interview Key Takeaway
Always set X-Content-Type-Options: nosniff to prevent browsers from executing non-executable uploads as scripts.
#MIME Sniffing#Headers#Web Security#Beginner
Back to all Web Security & Cyber Defense Questions→