# dont-sniff-mimetype

> Middleware to prevent mimetype from being sniffed

Latest version **1.1.0** (published 2019-05-11) · MIT license · 0 weekly downloads

## Install

```sh
npm install dont-sniff-mimetype
pnpm add dont-sniff-mimetype
yarn add dont-sniff-mimetype
bun add dont-sniff-mimetype
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.1.0 |
| Published | 2019-05-11 |
| First published | 2014-10-28 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=4.0.0 |
| Dependencies | 0 |
| Unpacked size | 4.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 18 |
| Author | Adam Baldwin |
| Maintainers | evanhahn |
| Keywords | helmet, security, express, connect, mimetype, x-content-type-options |

## Links

- npm: https://www.npmjs.com/package/dont-sniff-mimetype
- Repository: https://github.com/helmetjs/dont-sniff-mimetype
- Homepage: https://helmetjs.github.io/docs/dont-sniff-mimetype
- Issues: https://github.com/helmetjs/dont-sniff-mimetype/issues
- npm.io page: https://npm.io/package/dont-sniff-mimetype

## Recent versions

- 1.1.0 (latest) — 2019-05-11
- 1.0.0 — 2015-12-18
- 0.1.0 — 2014-10-28

## README

"Don't infer the MIME type" middleware
======================================
[![Build Status](https://travis-ci.org/helmetjs/dont-sniff-mimetype.svg?branch=master)](https://travis-ci.org/helmetjs/dont-sniff-mimetype)

Some browsers will try to "sniff" mimetypes. For example, if my server serves *file.txt* with a *text/plain* content-type, some browsers can still run that file with `<script src="file.txt"></script>`. Many browsers will allow *file.js* to be run even if the content-type isn't for JavaScript.

Browsers' same-origin policies generally prevent remote resources from being loaded dangerously, but vulnerabilities in web browsers can cause this to be abused. Some browsers, like [Chrome](https://developers.google.com/web/updates/2018/07/site-isolation), will further isolate memory if the `X-Content-Type-Options` header is seen.

There are [some other vulnerabilities](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/), too.

This middleware prevents Chrome, Opera 13+, IE 8+ and [Firefox 50+](https://bugzilla.mozilla.org/show_bug.cgi?id=471020) from doing this sniffing. The following example sets the `X-Content-Type-Options` header to its only option, `nosniff`:

```javascript
const nosniff = require('dont-sniff-mimetype')
app.use(nosniff())
```

[MSDN has a good description](http://msdn.microsoft.com/en-us/library/gg622941%28v=vs.85%29.aspx) of how browsers behave when this header is sent.

---
_Source: https://npm.io/package/dont-sniff-mimetype · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._