ASVS 5.0 requirement V3.4.4 says all HTTP responses must contain X-Content-Type-Options: nosniff. That header tells the browser to use the Content-Type you sent and not guess from the file contents. It is a Level 2 requirement.
Why it matters
Without the header, a browser may decide that a response labelled text/plain actually looks like HTML or JavaScript and run it. If your site lets users upload files or reflects content into a download, an attacker can use that guess to turn a harmless looking file into script that runs on your origin.
With nosniff, a script tag only accepts a response typed as JavaScript and a stylesheet link only accepts text/css. It also lets browsers apply Cross-Origin Read Blocking, which keeps cross-site pages from reading certain responses.
How to implement it
Add it globally, not per route.
add_header X-Content-Type-Options "nosniff" always;
app.use(helmet.noSniff());
Header always set X-Content-Type-Options "nosniff"
Pair it with correct content types. The header makes a wrong Content-Type fatal, so a script served as text/html will stop loading. That is the intended behavior, and it is a good reason to fix the types, see V4.1.1.
How to test it
for p in / /static/app.js /static/site.css /api/v1/health /missing; do
echo "$p: $(curl -sI https://app.example.com$p | grep -ic 'x-content-type-options: nosniff')"
done
Every path should print 1, including the 404. Check responses from your CDN and file download endpoints too.
Common mistakes
Setting it only on HTML. Scripts, styles, JSON and downloads need it as much as pages.
Missing on error responses. Use always in nginx and Apache.
Wrong value. nosniff is the only valid value, and spelling errors silently disable it.
Header lost at the CDN. Check the public URL, not just the origin server.
Quick check
Will nosniff break my site?
Only where your server sends the wrong Content-Type, for example JavaScript served as text/plain. Fix the type and the resource loads again.
Sources
- OWASP ASVS 5.0, requirement V3.4.4
- MDN: X-Content-Type-Options
