阅读中文版本

MIME Type Sniffing and nosniff

Browsers may ignore a declared Content-Type and infer a resource's real type from its leading bytes; X-Content-Type-Options: nosniff forces the declared type to be trusted instead.

Definition

MIME sniffing is the browser behaviour of inferring a response’s effective type by inspecting its leading bytes rather than trusting the Content-Type header that the server declared.

It affects every response an application serves that an attacker could influence, from user uploads to error pages that echo input. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.

When to use it

A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.

How it works

The browser looks at byte signatures such as a leading script or html prefix and can promote a text/plain body into executable markup, which turns a harmless upload endpoint into a cross-site scripting vector.

Sending X-Content-Type-Options: nosniff tells browsers to honour the declared type exactly, and modern engines additionally refuse to run scripts or apply styles whose type does not match.

Trade-offs and alternatives

Sniffing is a defence-in-depth concern: the durable fix is to serve untrusted content from a separate origin or with Content-Disposition: attachment so it is never parsed as a document. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.

Common misconceptions

A persistent misconception is that sniffing only ever makes rendering slightly more convenient. Another is that a correct Content-Type header removes all cross-site scripting risk. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.

Anti-patterns to avoid

Two recurring anti-patterns are to serving user uploads inline with a guessed media type and to omitting X-Content-Type-Options on JSON and HTML responses. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include Server Name Indication (SNI), Application-Layer Protocol Negotiation (ALPN), PROXY Protocol for Client Address Preservation.