Browsers will ignore content-type in many cases (html5 embraced that quirk), but they do have to sniff the bytes to confirm their hunch. You could use `file` to

Browsers will ignore content-type in many cases (html5 embraced that quirk), but they do have to sniff the bytes to confirm their hunch. You could use `file` to detect images. Or use the content length, maybe by changing hit quotas into bandwidth quotas. https://code.google.com/p/browsersec/wiki/Part2#Content_handling_mechanisms https://code.google.com/p/browsersec/wiki/Part2#Content_hand... http://mimesniff.spec.whatwg.org/ http://mimesniff.spec.whatwg.org/