4 ms·

So this is a hack in the browser to fix a security problem in the server. And it requires the same server to send an additional header. I wonder if they ever e

• tptacek 10y ago
  In practice it's very easy for most teams to make a policy decision about whether they want to disable content sniffing (most teams probably do) and then simply add a header to responses; in many organizations, that can happen without code changes. On the other hand, doing an inventory and then auditing every place where user-controlled content is replayed and then making and testing the requisite code changes is usually very difficult, and sometimes untenable.
• erlehmann_ 10y ago
  To me it looks like the actual security problem is that the browser does not trust the server, using its own heuristics instead. Mozilla asserts that as well: > While MIME sniffing increases the web experience for the majority of users, it also opens up an attack vector known as MIME confusion attack. The header tells the browser to stop shenanigans and behave.
• hannob 10y ago
  This is not a mozilla invention. The only thing Mozilla should be ciriticzed for is that they are the last implementing this. All other browsers already support this header. It's a bad situation, but it's based on bad decisions that were made in the 90s when the web was in its early days ("be liberal what you accept"). Hard to fix in a general way without breaking lots of stuff.