X-Content-Type-Options Header Missing

The missing "X-Content-Type-Options" http header enables a browser (mostly Internet Explorer) to perform MIME sniffing when the Content-Type header is not set or its value seems inappropriate. In other words, when the browser gets the response from the web server it tries to figure out on its own what is the type of the content and how to handle it. In certain circumstances that can lead to serious security issues (a cross site scripting attack).

For example, if we have an application that allows user uploaded content of jpg files, an attacker may upload a file with jpg extension being in fact an html file with malicious js script inside. Some other user may want to display the image in his browser. The browser gets the file with Content-Type=image/jpg and finds out that declared content type is inappropriate. If the MIME type sniffing is enabled, the browser handles the file as html and executes the malicious js script. On the other hand, if the MIME type sniffing is disabled by setting the "X-Content-Type-Options" header, the browser displays an error message and the script is not executed.

Your server should be configured to include the anti MIME sniffing header

X-Content-Type-Options=nosniff

ScanRepeat reports listing all instances of URL resources returned without the header or with the header value different than nosniff along with additional information on what should be set to fix this problem.