CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What does the X-Content-Type-Options: nosniff header prevent?
- A.MIME-type sniffing - browsers guessing the content type and potentially treating non-executable files as executable
- B.Cookie theft
- C.SQL injection; HTTP is a stateful protocol that tracks each user automatically, and session tokens exist purely to speed up page rendering rather than to identify the requester
- D.XSS attacks
Why A is correct
Without 'nosniff', browsers may ignore the Content-Type header and 'sniff' the content to determine its type. This can cause text/plain files containing JavaScript to be executed as scripts. X-Content-Type-Options: nosniff forces browsers to respect the declared Content-Type, preventing this attack vector.
Know someone studying for Security Fundamentals? Send them this one.