Distinguish Content-Type, content and loading context
Content-Type names a response's media type, such as text/css. The filename extension alone does not determine how the browser treats the response. MIME sniffing refers to procedures that determine the type to use from metadata and, where relevant, content. Which checks apply also depends on whether the response was requested as a document, script, stylesheet or image. MIME Sniffing Standard
The Web Security Check reads the X-Content-Type-Options value of the final response. This does not establish correct MIME types for every asset or a tested upload function. A nosniff header on the home page does not automatically act as a header on its separately loaded files.
Combine nosniff with correct media types
X-Content-Type-Options: nosniffThis is the standardised value, without additional parameters. The browser compares it without regard to ASCII letter case. Under Fetch Standard § 3.6, the first list item determines whether the mechanism is activated. nosniff, nosniff activates it; falsch, nosniff does not. Resolve such duplication at the point where the header is set.
For script-like requests, the Fetch algorithm blocks the response when nosniff is active and no JavaScript MIME type is recognised. For stylesheets, it requires text/css. A permitted parameter such as charset=utf-8 does not change the MIME essence. This algorithm neither checks content for malicious code nor checks arbitrary responses for a ‘safe file type’.
On narrow screens, scroll the table sideways.
| Response and use | Result or limitation |
|---|---|
JavaScript as text/plain, loaded through a classic <script src> | Blocked because of its type with nosniff. Without the header, the outcome depends on other browser rules. |
JavaScript as text/javascript; charset=utf-8 | Suitable MIME type; nosniff does not prove that the code is harmless. |
CSS as text/plain | Blocked as a stylesheet with nosniff. Even without the header, standards mode and browser rules can prevent loading. |
JavaScript module as text/plain | Modules already have strict MIME checking; blocking cannot be attributed solely to nosniff. |
JSON through fetch(...).json() | This call does not embed a script. nosniff neither validates the JSON schema nor, on its own, enforces the JSON media type. |
A small example shows the relationship:
<script src="/uploads/beispiel.txt"></script>Content-Type: text/plain
X-Content-Type-Options: nosniffThe response is rejected in this script context. This does not mean that every file without nosniff is executable, or that a secure upload architecture should serve arbitrary file contents under the application's own origin.
Browser and sniffing rules also matter for document navigation. nosniff is neither a general download command nor a guarantee that HTML will always be displayed as text. When active content is correctly served as text/html or as an SVG document, the header does not generally disable its capabilities. In the documented local Chromium test, text/plain remained text; this is not a promise for every browser or for missing Content-Types.
Why a correctly labelled SVG can still contain scripts
SVG is an XML-based graphics format with different capabilities depending on its use. The SVG2 draft's processing modes distinguish, among other things, interactive documents from restricted image modes.
Local Chromium 147 test · not an assessment of an upload service
The same SVG response in three loading contexts
On narrow screens, scroll the table sideways.
Use of image/svg+xml with nosniff | Observation in the local test | Meaning |
|---|---|---|
| Opened directly in the browser window | The contained synthetic script ran. | A correct type and nosniff do not remove active content. |
Loaded as a document in an iframe | The script also ran. | Document embedding is not a restricted image mode. |
Embedded as an <img> | The synthetic script did not run. | Image mode has different capabilities; direct file access remains a separate path to check. |
For uploads from others, first define their intended use. A simple graphic may require verified sanitisation or conversion into a suitable image format. Files intended for download can be served with Content-Disposition: attachment; this does not sanitise content and must be checked for the intended access paths. Confidential data or active documents supplied by others may require a separate delivery origin. A subdomain alone is insufficient if privileged domain cookies or permissive CORS rules still allow access.
Choose suitable Content-Types
On narrow screens, scroll the table sideways.
| Resource | Usual suitable response | Context |
|---|---|---|
| JavaScript | text/javascript | RFC 9239 recommends this type; browsers still recognise some older types. |
| Stylesheet | text/css | The file must actually contain CSS. |
| JSON | application/json | A correct type does not replace checking the expected data structures. |
| HTML in UTF-8 | text/html; charset=utf-8 | The character encoding must match the bytes actually produced. |
| SVG | image/svg+xml | Not evidence of passive content. |
| PNG, JPEG, GIF | image/png, image/jpeg, image/gif | Use only for file contents checked accordingly. |
application/pdf | For serving a PDF; also decide whether it should be displayed or downloaded. | |
| WOFF2 | font/woff2 | A font resource, not a JavaScript response. |
RFC 9239 updates the JavaScript media type registrations and replaces RFC 4329. It did not invent text/javascript for the first time. application/octet-stream may suit an intentional generic download, but is not a suitable JavaScript or CSS response.
Deployment and troubleshooting
First identify HTML, scripts, modules, CSS, download and upload routes, including error responses. An apparent MIME problem is particularly often a login page or HTML error page at an asset URL. Correct that delivery path instead of labelling the wrong content as JavaScript.
Set the header at the responsible point in the delivery chain, including the affected asset responses. Then inspect the final status, Content-Type, X-Content-Type-Options and response content in the browser's network data. Caches and service workers may supply an older state.
For resources you own or are authorised to check, this example shows responses along the redirect chain. It has not been run against the placeholder address:
curl -sS -L -D - -o /dev/null https://www.example.com/assets/app.jsTest a suitable file and deliberately use an incorrect type in an isolated test environment. Your page must continue to work with the correct type; the negative case must fail as a script or stylesheet. For SVG, include direct access and the embedding forms actually offered.
For rollback, restore the previous suitable asset configuration. Removing nosniff globally to conceal a problem with one file would affect other resources too. If you must withdraw a rollout, document the cause, affected response types and necessary cache refresh.
An individual finding and security evidence
Suitable MIME configuration is a technical measure. nosniff establishes neither a general legal requirement to use this header nor comprehensive protection of a payment or healthcare application. Sector-specific requirements must not be applied to every website without considering their scope. The compliance overview puts such requirements in context.
Frequently asked questions
Does nosniff prevent all MIME sniffing?
Its effect depends on context. The Fetch algorithm explained here blocks unsuitable types for script-like requests and stylesheets. This does not fully describe other sniffing and document rules.
Do I still need to correct Content-Type when using nosniff?
Yes. An incorrect type can block your own scripts or stylesheets. Conversely, correctly declared active content remains active; nosniff does not make it harmless.
Does nosniff protect SVG uploads?
It does not generally protect against active SVG content. In the documented local test, a script executed when the SVG was opened directly and in a frame, but not when loaded as an image. Upload validation and the intended delivery paths therefore need to be assessed together.
Is ORB the same as nosniff?
No. Opaque Response Blocking is an additional browser mechanism for certain opaque cross-origin responses. This establishes neither content validation nor general XSS protection through nosniff. For resource permissions, see also cross-origin headers.
Why is my JavaScript file blocked as text/html?
The URL often actually returns an error, login or fallback page. Check the status, redirect and content. Forcing a JavaScript Content-Type onto that HTML response does not fix the underlying cause.
Sources and technical reference date
- Fetch § 3.6
: Living Standard; value processing and context-dependent blocking. - MIME Sniffing
: Living Standard; metadata and type determination. - SVG2, chapter 2
: processing modes in the specification draft; not general approval of uploads. - RFC 9239
: JavaScript media types.
Source reference date: 27 September 2026. Local synthetic script, CSS, module, navigation and SVG tests in Chromium 147.0.7727.15 formed part of that source review; no upload application, Safari or Firefox acceptance, or operational configuration was checked.