Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

Medium

X-Content-Type-Options

Prevents browsers from guessing (MIME sniffing) the content type of a response, forcing them to respect the declared Content-Type.

Risk

Without this header, browsers may interpret a file differently than intended. An attacker can upload a file disguised as an image but containing JavaScript. The browser might MIME-sniff the content and execute the script, leading to XSS attacks. This is particularly dangerous for sites that allow file uploads.

Solution

Set X-Content-Type-Options to nosniff. Ensure all your resources are served with the correct Content-Type header.

Example

X-Content-Type-Options: nosniff

MDN - X-Content-Type-Options

Comments (0)

No messages yet.