liveBook · Manning

X-Content-Type-Options

As explained in ASP.NET Core in Action, 3e

X-Content-Type-Options is an HTTP response header that controls whether browsers may perform MIME-type sniffing.

X-Content-Type-Options is a security response header. Setting it to nosniff helps prevent browsers from MIME-type sniffing and adds protection against cross-site scripting attacks. section 31.1.3

Add the header as cross-cutting ASP.NET Core middleware:

  • Register a response-starting callback with context.Response.OnStarting. section 31.1.3
  • Call next() so the remaining pipeline generates the response. section 31.1.3

Apply it to every response

app.Use(async (HttpContext context, Func<Task> next) => { context.Response.OnStarting(() => { context.Response.Headers["X-Content-Type-Options"] = "nosniff"; return Task.CompletedTask; }); await next(); });

How ASP.NET Core in Action, 3e covers it

How deep it goes
Explains the header value and response-timing middleware, but does not detail MIME-sniffing internals.
Examples
Uses app.Use, Response.OnStarting, next(), and the nosniff header assignment as the working implementation.
What it assumes
Uses the Use extension, HttpContext, response headers, asynchronous middleware, and the next() pipeline delegate.
What you can do after
Apply it via ASP.NET Core middleware to attach nosniff reliably before responses begin streaming.
How it connects
Connects HTTP response headers with middleware, the ASP.NET Core request pipeline, MIME-type sniffing, and cross-site scripting.
Cover of ASP.NET Core in Action, 3e
liveBookmanning.com
Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain X-Content-Type-Options →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.