> For the complete documentation index, see [llms.txt](https://huy312100.gitbook.io/software-development/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://huy312100.gitbook.io/software-development/security/security-headers/x-content-type-options.md).

# X-Content-Type-Options

### What is X-Content-Type-Options? <a href="#what-is-x-content-type-options" id="what-is-x-content-type-options"></a>

Web-based security risks are quite prevalent in today's technological age. Therefore, it is important to implement certain security measures to help avoid having your website compromised by an attacker. The `X-Content-Type-Options` is an HTTP header used to do just that - **increase the security of your website**.

The `X-Content-Type-Options` HTTP header is a security header that is designed to protect web applications from [MIME type sniffing](https://www.keycdn.com/support/what-is-mime-sniffing) attacks. MIME type sniffing is a technique used by some web browsers to determine the MIME type of a file based on its content rather than relying on the MIME type that is declared in the Content-Type header. This can be a security risk because it can allow an attacker to execute malicious code on a website by tricking the browser into interpreting a file as a different MIME type than what it actually is.

The `X-Content-Type-Options` header was introduced to address this security issue. When the `X-Content-Type-Options` header is set to "nosniff", it instructs the browser to always use the MIME type that is declared in the Content-Type header rather than trying to determine the MIME type based on the file's content.

### Why is the `X-Content-Type-Options` HTTP header important? <a href="#why-is-the-x-content-type-options-http-header-important" id="why-is-the-x-content-type-options-http-header-important"></a>

The `X-Content-Type-Options` HTTP header is important because it can help prevent MIME type sniffing attacks, which can be used to execute malicious code on a website. By setting the `X-Content-Type-Options` header to "nosniff", you can ensure that the browser always uses the correct MIME type, which can help prevent these types of attacks.

In addition to protecting your website from attacks, using the `X-Content-Type-Options` header can also help ensure that your website is displayed correctly in all browsers. Different browsers may handle MIME types differently, so by setting the `X-Content-Type-Options` header, you can ensure that your website is displayed consistently across all browsers.

### How does `X-Content-Type-Options` work? <a href="#how-does-x-content-type-options-work" id="how-does-x-content-type-options-work"></a>

The `X-Content-Type-Options` header works by instructing the browser to always use the MIME type that is declared in the Content-Type header, rather than trying to determine the MIME type based on the file's content.

1. A browser makes a request to a web server for an asset (e.g. image.jpg).
2. A response is sent back with the header `X-Content-Type-Options`: nosniff. This prevents the client from "sniffing" the asset to try and determine if the file type is something other than what is declared by the server.
3. The browser then accepts the MIME type defined by the origin server and displays the asset to the viewer.

### What does it not protect against? <a href="#what-does-it-not-protect-against" id="what-does-it-not-protect-against"></a>

Unfortunately, the `X-Content-Type-Options`: nosniff header does not protect against all sniffing-related vulnerabilities. It is important to note that not all browsers support the `X-Content-Type-Options` header. However, all major modern browsers, including Chrome, Firefox, and Edge, do support it. This means that by using the `X-Content-Type-Options` header, you can protect your website from the majority of users who are using modern browsers.

<figure><img src="/files/5P3qaUFN06w0O6mf5ppI" alt=""><figcaption></figcaption></figure>

But if an unsupported browser accessed an asset which sends back this particular response header, it won't have any effect.

Similarly, if a plugin or extension (e.g. [Flash](https://security.stackexchange.com/questions/42904/flash-ignores-content-type-header-allowing-xss)) is being used to fetch resources and also does not support this security header, there will be no protection in that scenario either.

### Enabling the `X-Content-Type-Options` header[#](https://www.keycdn.com/support/x-content-type-options#enabling-the-x-content-type-options-header) <a href="#enabling-the-x-content-type-options-header" id="enabling-the-x-content-type-options-header"></a>

To enable this security header on your origin server is quite easily and can be done in just a couple steps. Depending upon which web server you're using will determine which snippet you should add to your server's configuration file. The following section outlines what needs to be added to both Nginx and Apache web servers.

#### Nginx <a href="#nginx" id="nginx"></a>

For Nginx users, add the following snippet to your .conf file. Once done, save your changes and reload Nginx.

```nginx
add_header X-Content-Type-Options "nosniff"
```

#### Apache <a href="#apache" id="apache"></a>

For Apache users, simply add the following snippet to your .htaccess file. Once done, save your changes.

```apacheconf
Header set X-Content-Type-Options "nosniff"
```

Enabling your web server to deliver the `X-Content-Type-Options` header is quite simple to do. Although this web security header currently does not protect against all forms of XSS attacks, it is **easy to implement** and is certainly a step in the right direction towards a safer website.

### Best practices for using the `X-Content-Type-Options` HTTP header <a href="#best-practices-for-using-the-x-content-type-options-http-header" id="best-practices-for-using-the-x-content-type-options-http-header"></a>

When using the `X-Content-Type-Options` HTTP header, there are a few best practices that you should follow to ensure that it is being used correctly.

First, it is important to ensure that the Content-Type header is set correctly for all files on your website. If the Content-Type header is not set correctly, the `X-Content-Type-Options` header may not work as intended. You can use a tool like the F12 Developer Tools in your browser to check the Content-Type header for each file on your website.

Second, it is recommended to use the `X-Content-Type-Options` header along with other security headers, such as the [X-XSS-Protection](https://www.keycdn.com/blog/x-xss-protection) and [X-Frame-Options](https://www.keycdn.com/blog/x-frame-options) headers. These headers can provide additional protection against cross-site scripting (XSS) and clickjacking attacks.

Finally, it is important to test your website thoroughly after implementing the `X-Content-Type-Options` header to ensure that it is working as intended. You can use a tool like the [SecurityHeaders scanner](https://securityheaders.com/) to check whether your website is using the `X-Content-Type-Options` header correctly.

### Conclusion <a href="#conclusion" id="conclusion"></a>

In conclusion, the `X-Content-Type-Options` HTTP header is an important security header that can help protect your website from MIME type sniffing attacks. By setting the header to "nosniff", you can ensure that the browser always uses the MIME type that is declared in the Content-Type header, which can help prevent these types of attacks.

Implementing the `X-Content-Type-Options` header is relatively simple, and it is recommended to use it along with other security headers for maximum protection. By following best practices and testing your website thoroughly, you can ensure that the `X-Content-Type-Options` header is working as intended and providing the necessary security for your website.

Remember, website security should always be a top priority, and using security headers like the `X-Content-Type-Options` header can go a long way in protecting your website and your users.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://huy312100.gitbook.io/software-development/security/security-headers/x-content-type-options.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.