Some browsers might try to sniff the mime type, so an additional header would help : "X-Content-Type-Options: nosniff"[1] 1. https://blogs.msdn.microsoft.com/i

Some browsers might try to sniff the mime type, so an additional header would help : "X-Content-Type-Options: nosniff"[1] 1. https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-part-vi-beta-2-update/ https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-...