Which HTTP header is used to prevent browsers from interpreting files as a different MIME type than specified?

Question

Web Development — Medium

Which HTTP header is used to prevent browsers from interpreting files as a different MIME type than specified?

Accepted Answer

The 'X-Content-Type-Options: nosniff' header prevents the browser from 'MIME-sniffing' a response away from the declared Content-Type. This is a security measure to prevent attackers from uploading malicious files disguised as safe types. Other options serve different security purposes: CSP for resource loading, X-Frame-Options for clickjacking, and HSTS for enforcing HTTPS.