X-Content Type Options

Learn how the X-Content-Type-Options header prevents MIME sniffing and enforces strict content-type handling in the browser.

X-Content-Type-Options adds the X-Content-Type-Options header to viewer-facing responses. When enabled, browsers that support this header use the declared Content-Type instead of attempting to infer the content type from the response body.

You can configure X-Content-Type-Options in the Medianova Control Panel or via the API.

Your origin must still provide the correct Content-Type value. X-Content-Type-Options does not correct an incorrect content type; it prevents browsers from overriding the declared value through MIME sniffing.

Configure X-Content-Type-Options

1

Open X-Content-Type-Options

Open your CDN Resource and select Headers.

Locate the X-Content-Type-Options section.

2

Enable X-Content-Type-Options

Enable X-Content-Type-Options.

When enabled, the CDN adds the following header to viewer-facing responses:

X-Content-Type-Options: nosniff

3

Save the Configuration

Click Save in the pending changes bar.

Review the pending changes and confirm the update.

Behavior

When X-Content-Type-Options is enabled:

• The CDN adds X-Content-Type-Options: nosniff to viewer-facing responses.

• Supporting browsers use the Content-Type declared by the server instead of attempting to infer a different content type from the response body.

• The setting does not modify the Content-Type value itself.

• The setting affects viewer-facing responses only and does not affect origin requests or CDN caching behavior.

When X-Content-Type-Options is disabled, the CDN does not add this header through this feature.