How can I add “X-Content-Type-Options: nosniff” to all the response headers

Question

I am running an ASP.NET MVC 3 website on IIS. Is there a flag in web.config or something similar that can do this?

Answer 1

As long as you're using IIS 7 or above, it's as simple as adding it to your web.config.

<configuration>
   <system.webServer>
      <httpProtocol>
         <customHeaders>
            <add name="X-Content-Type-Options" value="nosniff" />
         </customHeaders>
      </httpProtocol>
   </system.webServer>
</configuration>

Or you can add them using the IIS Management GUI, or even command line. Take a look at http://www.iis.net/configreference/system.webserver/httpprotocol/customheaders

Answer 2

This question originates from MVC 3, but as this problem is still relevant in ASP.NET Core, I'll let myself propose a solution for the recent versions:

 public static IApplicationBuilder UseNoSniffHeaders(this IApplicationBuilder builder)
 {
     return builder.Use(async (context, next) =>
     {
         context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
         await next();
     });
 }

Then simply add this in Startup.cs:

app.UseNoSniffHeaders();

The beauty of this approach is that it makes it independent from your web server and deployment process. At the same time you may need to extend this solution if you want it to apply to static files as well.