What is X-Content-Type-Options: nosniff?

Short answer

X-Content-Type-Options: nosniff is the response header that tells the browser to follow the type reported in the Content-Type header of the response and not to do MIME sniffing; MIME sniffing is the browser determining the type itself by looking at the content of the response. This way, for example, a file served as text or as an image is prevented from being run as a script or style in the browser. In TR7, when X-Content-Type-Options ("nosniff") is selected in the Response Headers list of the Manage HTTP Security Headers action, the header is added with the nosniff value to the responses coming from the Backend Service. If the Backend Service already sends the header, the existing header is not deleted, and a second X-Content-Type-Options is added next to it.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Actions (Policy Actions) → Manage HTTP Security Headers form	Response Headers → X-Content-Type-Options ("nosniff")	Preventing MIME sniffing
Load Balancer → Load Balancer vService List → HTTP vService form	Actions	Binding the action to the vService

The rule by which browsers comply with nosniff (the type matching in script and style responses) is defined in the WHATWG Fetch Standard.

Common Misconceptions

• "nosniff fixes a wrong Content-Type." It does not; if the Content-Type is wrong, the browser may not interpret the content correctly, and the script or style may not be loaded. The Backend Service needs to send the correct type.
• "The header is also added to the responses that TR7 produces." The action is applied only to the responses coming from the Backend Service; blocking and error pages do not get this header.
• "If the Backend Service sends the header, TR7 changes the value." X-Content-Type-Options is not written in place of the existing header, and a second header is added (overwriting the existing headers); if the Backend Service already sends it, the option does not need to be selected.

How it is done in the documentation

• Manage HTTP Security Headers · The Security Headers That Can Be Selected
• Manage HTTP Security Headers · Overwriting the Existing Headers

Related questions

• What is a MIME type (Content-Type)?
• What are HTTP security headers?
• Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?