Episode 80 - MIME Sniffing
About this episode
Any content served through HTTP “should” include meta data about its type. This is so the browser/client knows what to do with the content it receives. For example, if the content type header is an image the browser will preview it, if it is HTML it will render the markup and execute any javascript code.
Content type however is optional and web masters sometimes don’t set it, which leave the browsers wondering about the content type it is consuming. So browsers had to implement parsing and “sniffing” techniques to detect the type of content when a content type header was not served.
However, this caused security problems and attacks that we explain in this video! So to prevent sniffing, web servers can return X-Content-Type-Options: nosniff which opts out browsers from sniffing the content.
Media type: https://en.wikipedia.org/wiki/Media_type#Common_examples
Cheers!
Hussein Nasser
Get every episode summarized
Each time The Backend Engineering Show with Hussein Nasser publishes, we email you a written briefing from the transcript — the topics, who appeared, and any specific claims, with the ad reads skipped.
Email me new episodesFree for 3 shows. No card needed.
Hosts & guests
No transcript yet
This episode has not been transcribed. Request it and it moves to the front of the queue.
More episodes
More from The Backend Engineering Show with Hussein Nasser
Caching is a cop-out
The Backend Engineering Show with Hussein Nasser
How open ai agents "hacked" hugging face
The Backend Engineering Show with Hussein Nasser
How a query optimization gave birth to infinite scroll
The Backend Engineering Show with Hussein Nasser
Postgres is half as fast in Linux 7.0
The Backend Engineering Show with Hussein Nasser