MIME Sniffing & File Content Confusion: How X-Content-Type-Options: nosniff blocks polyglot attacks.

The Dangers of MIME Sniffing

Historically, when web servers served files with missing or incorrect Content-Type headers, browsers attempted to "sniff" the file content by inspecting its initial byte sequence. Attackers exploit this behavior using Polyglot Files.

Attacker crafts image file containing valid GIF magic bytes + malicious script:
GIF89a/* <script>alert(document.cookie);</script> */=1;

1. Attacker uploads file as avatar: "profile.gif".
2. Server serves file with Content-Type: text/plain or image/gif.
3. If MIME sniffing is enabled, the browser scans the content, detects <script> tags,
   overrides the Content-Type, and EXECUTES the file as HTML/JavaScript!

The Defense: X-Content-Type-Options: nosniff

X-Content-Type-Options: nosniff

This header instructs the browser strictly: "Trust the declared Content-Type header. Do NOT inspect the body to guess alternative MIME types." If a file is served as text/plain, the browser will never execute it as JavaScript or HTML.