Chapter 70: Permissions Policy & Modern Security Headers

Preventing MIME Sniffing: X-Content-Type-Options: nosniff

**Part 14: Security & Best Practices** — Chapter 70: Feature Policy & Permissions Policy

LEARNING OBJECTIVES ⌵
  • Understand browser MIME-type sniffing algorithms.
  • Learn how attackers disguise malicious JavaScript as harmless .jpg or .png user avatar uploads.
  • Enforce strict MIME verification using X-Content-Type-Options: nosniff.
  • Prevent drive-by downloads and script execution from user-uploaded asset endpoints.
🎬 INTERACTIVE VISUAL PIPELINE Core Architecture Simulation
🌐
1. Input
Directives & Tags
⚙️
2. Parse
Tokenizer & AST
🌳
3. Layout
Box Model & Flow
🎨
4. Render
GPU Paint & Composite
PHASE 1: INPUT & DIRECTIVES
Browser receives declarative markup stream, parsing tag tokens and initializing component state.

📖 The MIME Sniffing Exploit

Historically, if a web server returned a file with Content-Type: text/plain or image/jpeg, but the content began with <script>alert(1)</script>, older browsers would "sniff" the bytes, decide it was actually executable code, and run it as JavaScript!

Adding X-Content-Type-Options: nosniff tells the browser: "Trust my Content-Type header strictly. If a file is served as text/plain, do not execute it as a script or style under any circumstances."

X-Content-Type-Options: nosniff

📌 Key Takeaways

  • X-Content-Type-Options: nosniff is a mandatory security header for all HTTP responses.
  • It prevents browsers from executing user-uploaded files as scripts or stylesheets.
  • --

❓ Knowledge Check

1. Which of the following is correct?

2. Which of the following is correct?