Browser security
Compatibility & evidence
Transport and response hardening

X-Content-Type-Options nosniff

Prevents selected responses from being interpreted as a different MIME type.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

http.headers.X-Content-Type-Options
  1. 1 – 6363 recorded releases
    Works with limits
    • Partial implementation
    • Not supported for stylesheets.
  2. 64 – 15591 recorded releases
    Works

Edge

http.headers.X-Content-Type-Options
  1. 12 – 15482 recorded releases
    Works

Firefox

http.headers.X-Content-Type-Options
  1. 1 – 4952 recorded releases
    Not supported
  2. 50 – 157108 recorded releases
    Works

Safari

http.headers.X-Content-Type-Options
  1. 1 – 10.117 recorded releases
    Not supported
  2. 11 – 2744 recorded releases
    Works

Chrome for Android

http.headers.X-Content-Type-Options
  1. 18 – 6340 recorded releases
    Works with limits
    • Partial implementation
    • Not supported for stylesheets.
  2. 64 – 15591 recorded releases
    Works

Firefox for Android

http.headers.X-Content-Type-Options
  1. 4 – 4943 recorded releases
    Not supported
  2. 50 – 15798 recorded releases
    Works

Safari on iOS

http.headers.X-Content-Type-Options
  1. 1 – 10.314 recorded releases
    Not supported
  2. 11 – 2744 recorded releases
    Works

Android WebView

http.headers.X-Content-Type-Options
  1. 1 – 46 recorded releases
    Not supported
    • Partial implementation
    • Not supported for stylesheets.
  2. 4.4 – 6329 recorded releases
    Works with limits
    • Partial implementation
    • Not supported for stylesheets.
  3. 64 – 15591 recorded releases
    Works

Samsung Internet

http.headers.X-Content-Type-Options
  1. 1.0 – 8.220 recorded releases
    Works with limits
    • Partial implementation
    • Not supported for stylesheets.
  2. 9.0 – 30.032 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • MIME confusion
  • Unexpected script or style interpretation

Does not guarantee

  • Incorrect declared MIME types
  • Content injection
  • Every navigation response

What you need before using it

  • Correct Content-Type headers

Fallback to keep in place

Serve accurate media types and avoid hosting active content in untrusted upload locations.