This header protects against so called browser sniffing. When the browser itself determines the type of the file instead of obeying the defined type in the Content-Type header. Without this header, these browsers can incorrectly detect files as scripts and stylesheets, leading to XSS attacks.

Blocking the browser from guessing the filetype, also known as MIME-sniffing, based on the file content instead of the specified Content-Type. This will stop the browser from accidently execute a disguised malicious file but it only applies to files where the expected types is style or script.

This header has only one directive to add:

X-Content-Type-Options: nosniff

When it’s applied the browser will honor the Content-Type header specified for the file and block the request instead of executing it.

Although the header doesn’t have any drawbacks, only about 16% is using it*. Test to see if you have it on your site:

Adding it can look like this:

<add name="X-Content-Type-Options" value="nosniff"/>

Read more about: How to add headers to your .net site

Next up in the Security Headers series: Strict-Transport-Security