OWASPASVS 5.0 requirement
ASVS-V3.4.4 All http responses contain an 'x-content-type-options: nosniff' header field.
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.4 Browser Security Mechanism Headers
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that all HTTP responses contain an 'X-Content-Type-Options: nosniff' header field. This instructs browsers not to use content sniffing and MIME type guessing for the given response, and to require the response's Content-Type header field value to match the destination resource. For example, the response to a request for a style is only accepted if the response's Content-Type is 'text/css'. This also enables the use of the Cross-Origin Read Blocking (CORB) functionality by the browser.