What is 'X-Content-Type-Options: nosniff' and what attack does it prevent?

• A.nosniff prevents the browser from MIME-type sniffing - guessing a file's content type by inspecting its contents rather than trusting the Content-Type header. Without nosniff, a browser might execute an uploaded text file as JavaScript if it looks like JS. With nosniff, the browser strictly uses the declared Content-Type, preventing attackers from uploading content as one type (image, text) that gets executed as another
• B.nosniff prevents the browser from caching responses - storing a file's content for later requests rather than trusting the ETag header. Without nosniff, a browser might serve a stale uploaded text file since it looks unchanged. With nosniff, the browser strictly revalidates each response, preventing attackers from replaying content (images, text) that was cached under another URL
• C.nosniff prevents the browser from rendering inline frames - embedding another page by inspecting its headers rather than trusting the sandbox attribute. Without nosniff, a browser might render an uploaded HTML file inside a frame since it looks like a document. With nosniff, the browser strictly blocks framing, preventing attackers from embedding content (ads, widgets) that gets executed as the parent