* 仕様書

[REFS[
- [33] [CITE@en[Fetch Standard]] ([TIME[2017-05-05 16:10:45 +09:00]]) <https://fetch.spec.whatwg.org/#x-content-type-options-header>
]REFS]

* 歴史

** IE8

[REFS[
- [4] [CITE@en[IE8 Security Part V: Comprehensive Protection - IEBlog - Site Home - MSDN Blogs]] ([TIME[2012-11-18 01:11:22 +09:00]] 版) <http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx>
- [5] [CITE@en[IE8 Security Part VI: Beta 2 Update - IEBlog - Site Home - MSDN Blogs]] ([TIME[2012-11-18 01:19:40 +09:00]] 版) <http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx>
- [12] [CITE@en[Google Image Search and IE9 Beta - IEInternals - Site Home - MSDN Blogs]] ([TIME[2012-11-18 01:33:59 +09:00]] 版) <http://blogs.msdn.com/b/ieinternals/archive/2010/09/27/ie9-beta-google-image-search-javascript-content-type-and-nosniff.aspx>
- [7] [CITE@en[MIME-Handling Changes in Internet Explorer - IEBlog - Site Home - MSDN Blogs]] ([TIME[2012-11-18 01:22:10 +09:00]] 版) <http://blogs.msdn.com/b/ie/archive/2010/10/26/mime-handling-changes-in-internet-explorer.aspx>
- [9] [CITE@en-us[MIME-Handling Change: X-Content-Type-Options: nosniff (Windows)]] ([TIME[2012-11-18 01:25:56 +09:00]] 版) <http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx>
- [10] [CITE[Hosting - Google Chrome]] ([TIME[2012-11-18 01:28:56 +09:00]] 版) <http://developer.chrome.com/extensions/hosting.html>
-[1] [CITE[IRC logs: freenode / #whatwg / 20090129]] ([TIME[2009-02-01 13:25:37 +09:00]] 版) <http://krijnhoetmer.nl/irc-logs/whatwg/20090129#l-594>
-[2] [CITE@ja[HTTP ヘッダーに X-Content-Type-Options: nosniff を追加]]
([TIME[2010-10-27 15:13:40 +09:00]] 版)
<http://sqljp.com/yoshihirokawabata/archive/2009/03/30/26466.aspx>
]REFS]

** WHATWG

[REFS[
- [8] [CITE[471020 – Add X-Content-Type-Options: nosniff support to Firefox]] ([TIME[2012-11-18 01:24:32 +09:00]] 版) <https://bugzilla.mozilla.org/show_bug.cgi?id=471020>
- [11] [CITE[Issue 95901 - chromium - Consider implementing <script> MIME restrictions for X-Content-Type-Options: nosniff - An open-source browser project to help move the web forward. - Google Project Hosting]] ([TIME[2012-11-18 01:32:23 +09:00]] 版) <http://code.google.com/p/chromium/issues/detail?id=95901>
-[3] [CITE[''''''[''''''whatwg'''''']'''''' '''['''mimesniff''']''' The X-Content-Type-Options header]]
( ([TIME[2012-11-17 11:03:16 +09:00]] 版))
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2012-November/037974.html>
]REFS]

* テスト・ケース

[REFS[
- [6] [CITE[X-Content-Type-Options: nosniff tests]] ([TIME[2008-09-03 10:28:50 +09:00]] 版) <http://philip.html5.org/tests/ie8/cases/content-type-nosniff.html>
]REFS]

[13] [CITE[IRC logs: freenode / #whatwg / 20121116]]
( ([TIME[2012-12-02 12:20:05 +09:00]] 版))
<http://krijnhoetmer.nl/irc-logs/whatwg/20121116#l-1076>

[14] [CITE[チェンジセット 141985 – WebKit]]
( ([TIME[2013-02-16 06:01:20 +09:00]] 版))
<http://trac.webkit.org/changeset/141985>

[15] [CITE[''''''[''''''whatwg'''''']'''''' '''['''mimesniff''']''' First pass at speccing the X-Content-Type-Options header]]
( ([TIME[2013-05-11 04:15:37 +09:00]] 版))
<http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-May/039561.html>

[16] [CITE[MIME Sniffing Standard]]
( ([TIME[2013-05-10 18:47:10 +09:00]] 版))
<http://mimesniff.spec.whatwg.org/#determining-the-supplied-mime-type-of-a-resource>

[17] [CITE@en[X-Content-Type-Options: nosniff]]
([[Anne van Kesteren]] 著, [TIME[2015-04-02 16:41:42 +09:00]] 版)
<https://lists.w3.org/Archives/Public/public-webappsec/2015Apr/0004.html>

[18] [CITE@en[First draft of X-Content-Type-Options: nosniff. Fixes #35 · whatwg/fetch@cde532c]]
([TIME[2015-04-04 11:54:02 +09:00]] 版)
<https://github.com/whatwg/fetch/commit/cde532c00f410f44edb1f56f8aaa174bfedb16be>

[19] [CITE@en[Standardize "nosniff" · Issue #35 · whatwg/fetch]]
([TIME[2015-04-04 11:55:05 +09:00]] 版)
<https://github.com/whatwg/fetch/issues/35>

[20] [CITE@en[1150897 – Implement fetch "nosniff" spec changes]]
([TIME[2015-04-04 11:55:21 +09:00]] 版)
<https://bugzilla.mozilla.org/show_bug.cgi?id=1150897>

[21] [CITE@en[471020 – Add X-Content-Type-Options: nosniff support to Firefox]]
([TIME[2015-04-04 11:55:46 +09:00]] 版)
<https://bugzilla.mozilla.org/show_bug.cgi?id=471020>


[22] [CODE(HTMLe)@en[[[script]]]] [[要素]]や[[ワーカーコンストラクター]]や
[CODE(DOMm)@en[[[importScripts]]]] は[[MIME型]]を無視して [[JavaScript]]
として扱います。これを防ぐには [CODE(MIME)@en[[[X-Content-Type-Options:]] [[nosniff]]]]
を使うしかありません。

[32] [CITE@en[Remove X-Content-Type-Options as it's defined by Fetch]] ([[annevk]]著, [TIME[2016-07-18 18:29:47 +09:00]]) <https://github.com/whatwg/mimesniff/commit/64bfe025012be3ded16ac4978844acc0e8dfec3c>

[FIG(quote)[
[FIGCAPTION[
[23] [CITE@en-US[Mitigating MIME Confusion Attacks in Firefox | Mozilla Security Blog]]
([TIME[2016-09-15 20:00:25 +09:00]])
<https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-in-firefox/>
]FIGCAPTION]

> Starting with Firefox 50, Firefox will reject stylesheets, images or scripts if their MIME type does not match the context in which the file is loaded if the server sends the response header “X-Content-Type-Options: nosniff” (view specification). More precisely, if the Content-Type of a file does not match the context (see detailed list of accepted Content-Types for each format underneath) Firefox will block the file, hence prevent such MIME confusion attacks and will display the following message in the console:

]FIG]


[FIG(quote)[
[FIGCAPTION[
[24] [CITE@en-US[Mitigating MIME Confusion Attacks in Firefox | Mozilla Security Blog]]
([TIME[2016-09-15 20:00:50 +09:00]])
<https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-in-firefox/>
]FIGCAPTION]

> Valid Content-Types for Stylesheets:
> – “text/css”
> Valid Content-Types for images:
> – have to start with “image/”
> Valid Content-Types for Scripts:
> – “application/javascript”
> – “application/x-javascript”
> – “application/ecmascript”
> – “application/json”
> – “text/ecmascript”
> – “text/javascript”
> – “text/json”

]FIG]


[25] [CITE@en[1302539 – X-Content-Type-Options: nosniff breaks this page in Firefox but not in Chrome]]
([TIME[2016-09-19 18:16:04 +09:00]])
<https://bugzilla.mozilla.org/show_bug.cgi?id=1302539>

[26] >>25 [[Hixie]] の予言通りのことが起こったわけですな。。。

[FIG(quote)[
[FIGCAPTION[
[27] [CITE[IRC logs: freenode / #whatwg / 20080903]]
([TIME[2016-09-19 18:25:07 +09:00]])
<http://krijnhoetmer.nl/irc-logs/whatwg/20080903#l-573>
]FIGCAPTION]

> 
> # '''['''11:52''']''' <Hixie> i can't wait for X-Content-Type-Options: nosniff-seriously
> # '''['''11:53''']''' <Hixie> and X-Content-Type-Options: nosniff-pleeeease-please-i-mean-it-this-time-really

]FIG]


[28] [CITE@en[Only use nosniff for "script" and "style"]]
([[annevk]]著, [TIME[2016-12-19 18:34:33 +09:00]])
<https://github.com/whatwg/fetch/commit/169de91ca9fa3ab91a860bc492caf5fa94c29592>

[29] [CITE@en[Stop lowercasing header names]]
([[annevk]]著, [TIME[2017-02-22 20:01:22 +09:00]])
<https://github.com/whatwg/fetch/commit/5869c43a27fff06c6dfc228fe1288018f7f2168d>

[30] [CITE@en[Breaking: redo value parsing as value extraction]]
([[annevk]]著, [TIME[2017-02-22 23:42:59 +09:00]])
<https://github.com/whatwg/fetch/commit/68a986772901fe74f666f76a389dbc56cac1ad21>

[FIG(quote)[
[FIGCAPTION[
[31] [CITE@en[Abusing JSONP with Rosetta Flash]]
( ([[Michele Spagnuolo]]著, [TIME[2017-03-10 12:48:46 +09:00]]))
<https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/>
]FIGCAPTION]

> Furthermore, to hinder this attack vector in most modern browsers you can also return the HTTP header X-Content-Type-Options: nosniff. If the JSONP endpoint returns a Content-Type which is not application/x-shockwave-flash (usually application/javascript or application/json), Flash Player will refuse to execute the SWF.

]FIG]

[34] [[Chrome]] は [[binary data bytes]] の検査を実装していますが、
[[Firefox]] は実装していないようにみえます。 [TIME[2017-05-06T15:58:24.500Z]]

[35] [[navigate]] 時の [[sniffing]] に [CODE[X-Content-Type-Options:]]
を [[Chrome]] は反映させますが (削除前の [[MIME Sniffing Standard]] の動作)、
[[Firefox]] は反映させません。 [TIME[2017-05-06T15:59:10.200Z]]

[36] [CITE[MIME Sniffing Standard]] の昔の規定に従えば
[CODE[X-Content-Type-Options: nosniff]] が指定されていても
[CODE(HTTP)@en[Content-Type:]] が指定されていない場合は
[[binary data bytes]] の検査が行われるはずですが、
[[Chrome]] は行いません
([CODE(MIME)@en[text/plain]] とします)。 [TIME[2017-05-07T04:42:10.700Z]]

[37] [CITE@en[Fold request type into destination]]
([[annevk]]著, [TIME[2017-08-28 18:15:21 +09:00]])
<https://github.com/whatwg/fetch/commit/d7052e2b6d24d04caa2cea8ef664923ecdb1e35c>

[38] [CITE@en[Meltdown/Spectre  |  Web  |  Google Developers]]
([TIME[2018-02-08 00:05:08 +09:00]])
<https://developers.google.com/web/updates/2018/02/meltdown-spectre>

[39] [CITE@en[CORB: protecting certain nosniff and 206 responses]]
([[anforowicz]]著, [TIME[2018-05-17 16:24:03 +09:00]])
<https://github.com/whatwg/fetch/commit/794dd5452705564538440cc5b2c1f13d909e2f9a>

[40] [CITE@en[CORB: protecting certain nosniff and 206 responses]]
([[anforowicz]]著, [TIME[2018-05-17 16:24:03 +09:00]])
<https://github.com/whatwg/fetch/commit/794dd5452705564538440cc5b2c1f13d909e2f9a>

[41] [CITE@en[CORB: blocking of nosniff and 206 responses by anforowicz · Pull Request #686 · whatwg/fetch]]
([TIME[2018-05-19 12:13:25 +09:00]])
<https://github.com/whatwg/fetch/pull/686>

[42] [CITE@en[CORB: blocking of nosniff and 206 responses by anforowicz · Pull Request #686 · whatwg/fetch]]
([TIME[2019-02-18 17:13:20 +09:00]])
<https://github.com/whatwg/fetch/pull/686>

[43] [CITE@en[Define parsing for X-Content-Type-Options: nosniff in detail]]
([[annevk]]著, [TIME[2018-11-01 18:14:30 +09:00]])
<https://github.com/whatwg/fetch/commit/32c7b1c76a43ea96b8663628b891b339553ae114>

[44] [CITE@en[What does "combined value" return for a name not in the header list? · Issue #752 · whatwg/fetch]]
([TIME[2019-03-04 19:55:27 +09:00]])
<https://github.com/whatwg/fetch/issues/752>

[45] [CITE@en[Define parsing for X-Content-Type-Options in detail by annevk · Pull Request #818 · whatwg/fetch]]
([TIME[2019-03-04 19:56:07 +09:00]])
<https://github.com/whatwg/fetch/pull/818>

[46] [CITE@en[Define parsing for X-Content-Type-Options in detail by annevk · Pull Request #818 · whatwg/fetch]]
([TIME[2019-03-04 19:57:38 +09:00]])
<https://github.com/whatwg/fetch/pull/818>

[47] [CITE@en[Define the Content-Type header parser]]
([[annevk]]著, [TIME[2018-11-27 18:47:01 +09:00]])
<https://github.com/whatwg/fetch/commit/0b2bc05b2550dcbefe1321ea3e8026702514a798>