MIME Sniffing.

MIME sniffing is a legacy browser feature in which the browser inspects the first bytes of a response and overrides the server-declared Content-Type header to render the resource more usefully. Attackers abuse this when an application serves user-uploaded files with an incorrect or generic type: a file containing HTML or JavaScript may be sniffed as text/html and executed in the victim's origin, enabling stored XSS.

The behaviour dates to early Internet Explorer, whose aggressive sniffing was a notorious source of "content-type confusion" XSS; Microsoft introduced the X-Content-Type-Options: nosniff opt-out in IE8 (2008), and it is now standardised by the WHATWG Fetch specification's MIME Sniffing Standard. Sending nosniff forces the browser to honour the declared type and refuse to execute a script or stylesheet whose Content-Type does not match the request destination. Modern hardening layers several controls: serve every user-supplied file with a correct, specific Content-Type and a Content-Disposition: attachment where appropriate, host user content on a separate sandbox origin, and enforce a restrictive Content-Security-Policy. Security scanners and headers graders (for example Mozilla Observatory) flag any HTML response missing nosniff.

flowchart TD
  A[User uploads file] --> B[App serves it back<br/>with wrong/generic type]
  B --> C{X-Content-Type-Options:<br/>nosniff set?}
  C -- No --> D[Browser sniffs bytes,<br/>renders as text/html]
  D --> E[Stored XSS executes<br/>in victim origin]
  C -- Yes --> F[Browser honours<br/>declared type]
  F --> G[File downloaded, not executed]