While testing some HTTP server code, I noticed something odd: if I return Content-Type: text/plain
, browsers will not render the content as plain text. Instead, they seem to assume that the server must be misconfigured, and they try to detect the content type instead.
For example, if I return the contents of a PNG file, but with Content-Type: text/plain
:
.png
, they display it as an image. If not (e.g. if I return the same content from a URL that ends in .xyz
), they prompt me to save the file.Granted, it wouldn't make sense to return a PNG as text/plain
in production; but if I'm testing whether my server is returning the correct Content-Type
, the browsers' second-guessing behavior gets in the way. Plus it's just kinda goofy, which gets me curious about whether there's a way to work around it.
Is there a way -- with a different Content-Type
, or an additional HTTP header, or whatever -- that I can tell the browser, "Show this as text, no really, I actually know what I'm doing"?
See https://datatracker.ietf.org/doc/html/draft-ietf-websec-mime-sniff-03#section-4 for context.
In some UAs, adding as custom parameter such as
text/plain; imeanit=yes
might help.
Some IE versions support
X-Content-Type-Options: nosniff
see http://msdn.microsoft.com/en-us/library/gg622941%28v=vs.85%29.aspx
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With