Home / Knowledge hub / Content sniffing
Knowledge hub
Content sniffing
A browser guessing a file's real type, which can turn an upload into a script.
What it means
Content sniffing, or MIME sniffing, is when a browser ignores or second-guesses the Content-Type your server sent, and looks inside the file to decide what it is. It began as a way to cope with sites that sent wrong types, and the behaviour is written into the WHATWG MIME Sniffing standard.
A file that your server calls text can be treated as HTML if it contains HTML-like content. The label is a hint, not a guarantee, unless you tell the browser to trust it.
Why it matters
If your product accepts uploads, avatars, attachments or documents, someone can upload a file built to be misread. A browser that sniffs may render it as a page and run its script, with your domain's cookies and rights. That is stored cross-site scripting delivered by a file.
The harm is real but avoidable. A few headers and storage choices remove it, and a customer's security questionnaire will often ask about them, so it is worth fixing once, properly, before a review asks.
How it shows up
You meet it wherever users supply files or text that you serve back. Typical weak spots: user content on the main domain, downloads without a Content-Disposition header, JSON or text endpoints with the wrong type, and old Internet Explorer behaviour that some enterprise users still have.
The usual defences work together. Send X-Content-Type-Options: nosniff. Always set a correct Content-Type. Serve uploads from a separate domain, with attachment disposition where possible. Validate type by content, not by extension. Test by uploading a file with a mislabelled type.
Questions people ask
Content sniffing, answered
How does nosniff stop content sniffing?
It tells the browser to trust the declared Content-Type and not to guess. A text file stays text, even if it contains HTML.
It also blocks mismatched scripts and stylesheets.
Is content sniffing the same as file type validation?
No. Validation is your server checking what a file is on upload. Sniffing is the browser guessing on download.
You need both, because a file that looks harmless to you can still be misread by a browser.
Why not just rely on the file extension?
Extensions are chosen by the uploader and can be anything. Browsers use the Content-Type, and may use contents, not the extension.
Set the type yourself from a trusted list.
Should uploads be served from the main domain?
Preferably not. A separate domain keeps any script that does run away from your cookies and sessions.
It is one of the most effective changes you can make.
How would a pentest test for it?
By uploading files with mixed content and wrong types, then opening the stored file URLs in a browser to see what runs.
The report shows the file, the headers and the result.
Sources
Where this comes from
Related
Terms that sit next to this one
X-Content-Type-Options
A header that stops browsers guessing a file's type and running it as a script.
XSS
An attacker's script running in your pages, in your customers' sessions.
Stored XSS
Malicious script saved by your app and then served to other people who view it.
Security headers
Response headers that switch on browser protections against common web attacks.
Input validation
Checking that what arrives is the shape and range you expected.
Can a browser misread your uploads?
File uploads that a browser will run as pages or scripts are tested on the running app and proven with the stored file and the request, not just flagged. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.