title: X-Content-Type-Options Header Missing
body: <p>I am developing a web application in angularjs5. The security team is testing our application and raised the bug. </p>
  
  <p>Description: The Anti-MIME-Sniffing header X-Content-Type-Options was
  not set to '<code>nosniff</code>'. This allows older versions of Internet Explorer
  and Chrome to perform MIME-sniffing on the response body, potentially
  causing the response body to be interpreted and displayed as a content
  type other than the declared content type. Current (early 2014) and
  legacy versions of Firefox will use the declared content type (if one
  is set), rather than performing MIME-sniffing.</p>
  
  <p>Url:
  <a href="http://mywebsite.azurewebsites.net/dist/vendor.js?v=vBjTOpDNRC-nQNYd5TD5g6hxfdfdjc7SPrvBv0o2pPs" rel="nofollow noreferrer">http://mywebsite.azurewebsites.net/dist/vendor.js?v=vBjTOpDNRC-nQNYd5TD5g6hxfdfdjc7SPrvBv0o2pPs</a></p>
  
  <p>method:<code>Get</code> </p>
  
  <p>Parameter:<code>X-Content-Type-Options</code> </p>
  
  <p>Solution: Ensure that the
  application/web server sets the Content-Type header appropriately, and
  that it sets the X-Content-Type-Options header to '<code>nosniff</code>' for all
  web pages.</p>
  
  <p>If possible, ensure that the end user uses a standards-compliant and
  the modern web browser that does not perform MIME-sniffing at all, or that
  can be directed to the web application/web server to not perform
  MIME-sniffing.</p>
  
  <p>I have set header   'X-Content-Type-Options': '<code>nosniff</code>' in all HTTP requests as below.</p>
  
  <pre><code> protected getRequestHeaders(): { headers: HttpHeaders | { [header: string]: string | string[]; } } {
          let headers = new HttpHeaders({
              'Authorization': `Bearer ${this.appContextService.userToken}`,
              'Content-Type': 'application/json',
              'Accept': 'application/json',
              'Ocp-Apim-Subscription-Key': ` ${this.appContextService.subscriptionKey}`,
              'X-Frame-Options': 'Deny',
              'X-XSS-Protection': '1',
              'X-Content-Type-Options': 'nosniff',
              'cache-control':'max-age=3153600'
          });
          return { headers: headers };
      }
  </code></pre>
  
  <p>Can someone help me to set header X-Content-Type-Options to dist/vendor.css,dist/main-client.jsdist/vendor.js? Any help would be appreciated. Thank you.</p>