From 8bb912dbf2a8d2e0fa4abac657b8fb573b6c81bb Mon Sep 17 00:00:00 2001 From: Ashish-coder-gif Date: Wed, 22 Oct 2025 16:27:37 +0530 Subject: [PATCH] docs: add example for X-Content-Type-Options header --- fetch.bs | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/fetch.bs b/fetch.bs index 8d19ae84d..ff7061f00 100755 --- a/fetch.bs +++ b/fetch.bs @@ -4202,6 +4202,23 @@ Content-Type:

`X-Content-Type-Options` header

+
+

Example: Using the X-Content-Type-Options header to prevent MIME type sniffing.

+ 
HTTP/1.1 200 OK
+Content-Type: text/html; charset=utf-8
+X-Content-Type-Options: nosniff
+
+<!doctype html>
+<html>
+  <head><title>Secure Page</title></head>
+  <body>
+    <script src="data:text/plain,alert('This script will be blocked')"></script>
+  </body>
+</html>
+
+

This prevents browsers from interpreting resources as a different MIME type than declared, + helping to mitigate certain types of cross-site scripting attacks.

+

The `X-Content-Type-Options`