CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What does the X-Content-Type-Options: nosniff header prevent?
- A.A. XSS attacks
- B.C. Cookie theft
- C.B. MIME-type sniffing - browsers guessing the content type and potentially treating non-executable files as executable
- D.D. SQL injection
Why C is correct
Without 'nosniff', browsers may ignore the Content-Type header and 'sniff' the content to determine its type. This can cause text/plain files containing JavaScript to be executed as scripts. X-Content-Type-Options: nosniff forces browsers to respect the declared Content-Type, preventing this attack vector.
Know someone studying for Security Fundamentals? Send them this one.