title: Security of Content-Type and X-Content-Type-Options headers
body: <p>While going through the material on web application vulnerabilities, I came across some queries. Here are the details. </p>
  
  <ul>
  <li><p>The tools like burp, APPScan reports the vulnerabilities based on specific response header from the application server. I understood that there are certain headers which are complementary to one another. For Ex:- 'Content-type' and 'X-Content-Type-Options'. If second is set to 'nosniff', the browser will not sniff the response body at all and will honor the value set in 'Content-Type' header. Similarly, the HTTP request also can indicate the type of response it is expecting using 'Accept' kind of headers. In such cases, do I need to consider application vulnerable if 'X-Content-Type-Options' is not set to 'nosniff' while the request for such response has 'Accept' parameter indicating media type only to text/plain? </p></li>
  <li><p>The other extension to this query is that if the response header has the following fields set. <code>Content-Type=text/plain X-Content-Type-Options=nosinff</code>. In my opinion, this is not a vulnerability since second parameter will restrict browser from sniffing the response body. Is my understanding correct from security perspective ?</p></li>
  </ul>