#339 · Developer Tool

X Content Type Options Checker

Check whether a response carries a valid X-Content-Type-Options: nosniff header and whether its declared Content-Type fits the resource type you expect. The checker catches misspelled values, duplicate fields, missing MIME types, and common script or stylesheet mismatches. It does not download a URL, so you can inspect headers copied from browser developer tools, curl, a proxy, or a deployment log.

Developer Input

Response headers
Ad space

How to use this developer tool

  1. Paste the response headers or load the included sample.
  2. Adjust any tool-specific option shown below the input.
  3. Select Check nosniff or press Ctrl/Cmd + Enter.
  4. Review the summary and findings, then copy or download the output.

What this developer tool does

Parses X-Content-Type-Options and Content-Type case-insensitively, requires the exact nosniff token, and compares MIME families with an optional expected resource type.

Parses X-Content-Type-Options and Content-Type case-insensitively, requires the exact nosniff token, and compares MIME families with an optional expected resource type.

nosniff strengthens MIME enforcement. Correct Content-Type headers are still required for scripts, modules, and stylesheets.

Example

Input

Content-Type: text/javascript; charset=utf-8
X-Content-Type-Options: nosniff

Output

nosniff: valid
Content-Type: text/javascript
Expected type: script
MIME match: yes

Use cases

  • Review a deployment before changing production response headers.
  • Compare application and reverse-proxy configuration.
  • Create a reproducible finding for a security review or pull request.
  • Teach the practical effect of X Content Type Options settings.

Tips for reliable output

  • Use the complete header value, including repeated fields.
  • Test the final response after CDN and proxy processing.
  • Keep a copy of the before and after output for review.
  • Do not treat a passing result as a penetration test.
  • Recheck after framework, server, or browser-policy updates.

Processing details

Add expected=script, style, json, html, image, or font on its own input line to enable the contextual MIME check.

The result does not model every browser MIME rule or validate the response body against the declared media type.

Frequently asked questions

What exact value should X-Content-Type-Options use?

The checker reports this directly from the supplied response headers and shows the relevant value in its output.

Why does nosniff block a JavaScript module response?

Use the result together with the browser and server behavior you support; the page does not make remote requests.

Does nosniff matter when Content-Type is already correct?

Review the generated finding before deployment, especially when proxies or CDNs can alter headers.

Can X-Content-Type-Options contain multiple values?

The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.

How do I check a stylesheet served as text/plain?

Retest with the exact production response because small header changes can affect the conclusion.

Checks and output

StageWhat is reported
ParseRecognized input fields and values
ValidateInvalid, missing, or conflicting settings
ExportText, CSV, and JSON when structured data is available

HTTP & Security Headers

Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.

View HTTP & Security Headers