> could be tricked to ignore the Content-Type I think even browser nowadays still do it. A file in <script src="" /> will be treated as script even mime is wro

> could be tricked to ignore the Content-Type I think even browser nowadays still do it. A file in <script src="" /> will be treated as script even mime is wrong. A file ended with .mp4 will be play as video even it says it is a text/plain file. Browser guess mime from contents at many places, just you may not notice it. unless XCTO is set