Content Type Sniffing
Overview
Browsers that MIME-sniff responses can interpret uploaded files differently from the declared content type. An attacker uploads an HTML file disguised as an image, and the browser sniffs it as HTML and executes the embedded JavaScript.
X-Content-Type-Options: nosniff prevents this sniffing behavior.
Remediation
- Set
X-Content-Type-Options: nosniffon all responses - Always declare the correct Content-Type for served files
- Do not serve user-uploaded content from the same origin as the application