blob: d3f4c72c6768d555d35ac9fd76377bbc175252fe (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
---
stage: Secure
group: Dynamic Analysis
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
---
# Missing X-Content-Type-Options: nosniff
## Description
The `X-Content-Type-Options` header with the value `nosniff` ensures that user agents do not attempt to
guess the format of the data being received. User Agents such as browsers, commonly attempt to guess
what the resource type being requested is, through a process called MIME type sniffing.
Without this header being sent, the browser may misinterpret the data, leading to MIME confusion attacks.
If an attacker were able to upload files that are accessible by using a browser, they could upload files
that could be interpreted as HTML and execute Cross-Site Scripting (XSS) attacks.
## Remediation
We recommend that the header and value of `X-Content-Type-Options: nosniff` be set server wide.
This ensures any resources that are mistakenly missing a `Content-Type` value are not
misinterpreted.
## Details
| ID | Aggregated | CWE | Type | Risk |
|:---|:--------|:--------|:--------|:--------|
| 693.1 | true | 693 | Passive | Low |
## Links
- [OWASP](https://owasp.org/www-project-secure-headers/#x-content-type-options)
- [CWE](https://cwe.mitre.org/data/definitions/693.html)
- [Mozilla Blog on MIME Confusion attacks](https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-in-firefox/)
- [Mozilla MDN on X-Content-Type-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options)
|
