title: When should I use HTTP header "X-Content-Type-Options: nosniff"
body: <p>I've been running some penetration tests using <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project" rel="noreferrer">OWASP ZAP</a> and it raises the following alert for all requests: <a href="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#xcto" rel="noreferrer"><code>X-Content-Type-Options Header Missing</code></a>.</p>
  
  <p>I understand the header, and why it is recommended.  It is explained very well in <a href="https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff">this StackOverflow question</a>.</p>
  
  <p>However, I have found various references that indicate that it is only used for .js and .css files, and that it might actually be a <em>bad</em> thing to set the header for other MIME types:</p>
  
  <ul>
  <li><em>Note: nosniff only applies to "script" and "style" types. Also applying nosniff to images turned out to be incompatible with existing web sites.</em> <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options" rel="noreferrer">[1]</a></li>
  <li><em>Firefox ran into problems supporting nosniff for images (Chrome doesn't support it there).</em> <a href="https://github.com/whatwg/fetch/issues/395" rel="noreferrer">[2]</a></li>
  <li><em>Note: Modern browsers only respect the header for scripts and stylesheets and sending the header for other resources (such as images) when they are served with the wrong media type may create problems in older browsers.</em> <a href="https://webhint.io/docs/user-guide/hints/hint-x-content-type-options/" rel="noreferrer">[3]</a></li>
  </ul>
  
  <p>The above references (and others) indicate that it is bad to simply set this header for all responses, but despite following any relevant-looking links and searching on Google, I couldn't find any reason behind this argument.</p>
  
  <p>What are the risks/problems associated with setting <code>X-Content-Type-Options: nosniff</code> and why should it be avoided for MIME types other than <code>text/css</code> and <code>text/javascript</code>?</p>
  
  <p>Or, if there are no risks/problems, why are Mozilla (and others) suggesting that there are?</p>