X-Content-Type-Options header does not have the supported nosniff value
The fetched content response lacked the exact supported X-Content-Type-Options: nosniff value.
Why it matters
X-Content-Type-Options is a response-header setting that applications can configure alongside their intended content types. This finding identifies an observed header state for review without determining how any browser would handle a particular asset.
How ShipReady detects it
What it inspects
ShipReady reads normalized response headers from a successfully fetched, readable, same-site content-serving 2xx final response.
What triggers a finding
The rule triggers when X-Content-Type-Options is absent, empty, or differs from nosniff after case normalization.
What the evidence shows
The observed content response did not contain the exact supported X-Content-Type-Options: nosniff value.
Limits of this check
ShipReady does not inspect asset MIME types, uploads, browser MIME decisions, or every site route. It checks the final fetched response rather than redirect hops and does not demonstrate MIME-sniffing exploitation or executable upload behavior.
How to fix it
Send the supported header value
Configure the application, proxy, or CDN to send X-Content-Type-Options: nosniff on the intended content responses.
Review content-serving routes
Independently verify that application and upload-serving routes use intentional content types and headers; this scanner rule does not inspect them comprehensively.
How to verify the change
Inspect deployed response headers
Request representative deployed content URLs and inspect their final response headers after deployment.
Expected: The intended content responses include X-Content-Type-Options: nosniff.