Missing X-Content-Type-Options: nosniff

Description

The X-Content-Type-Options header with the value nosniff ensures that user agents do not attempt to guess the format of the data being received. User Agents such as browsers, commonly attempt to guess what the resource type being requested is, through a process called MIME type sniffing.

Without this header being sent, the browser may misinterpret the data, leading to MIME confusion attacks. If an attacker were able to upload files that are accessible by using a browser, they could upload files that could be interpreted as HTML and execute Cross-Site Scripting (XSS) attacks.

Remediation

We recommend that the header and value of X-Content-Type-Options: nosniff be set server wide. This ensures any resources that are mistakenly missing a Content-Type value are not misinterpreted.

Details

ID	Aggregated	CWE	Type	Risk
693.1	true	693	Passive	Low

Help & feedback

Docs

Edit this page to fix an error or add an improvement in a merge request.
Create an issue to suggest an improvement to this page.

Product

Create an issue if there's something you don't like about this feature.
Propose functionality by submitting a feature request.
Join First Look to help shape new features.

Feature availability and product trials

View pricing to see all GitLab tiers and features, or to upgrade.
Try GitLab for free with access to all features for 30 days.

Get Help

If you didn't find what you were looking for, search the docs.

If you want help with something specific and could use community support, post on the GitLab forum.

For problems setting up or using this feature (depending on your GitLab subscription).

Request support