While testing some HTTP server code, I noticed something odd: if I return Content-Type: text/plain, browsers will not render the content as plain text. Instead, they seem to assume that the server must be misconfigured, and they try to detect the content type instead.
For example, if I return the contents of a PNG file, but with Content-Type: text/plain:
- FireFox and IE9 both look at the extension on the URL. If it ends in
.png, they display it as an image. If not (e.g. if I return the same content from a URL that ends in.xyz), they prompt me to save the file. - Chrome and Opera both look at the file’s contents, detect that it’s a PNG, and display it as an image.
Granted, it wouldn’t make sense to return a PNG as text/plain in production; but if I’m testing whether my server is returning the correct Content-Type, the browsers’ second-guessing behavior gets in the way. Plus it’s just kinda goofy, which gets me curious about whether there’s a way to work around it.
Is there a way — with a different Content-Type, or an additional HTTP header, or whatever — that I can tell the browser, “Show this as text, no really, I actually know what I’m doing”?
See https://datatracker.ietf.org/doc/html/draft-ietf-websec-mime-sniff-03#section-4 for context.
In some UAs, adding as custom parameter such as
text/plain; imeanit=yes
might help.
Some IE versions support
X-Content-Type-Options: nosniff
see http://msdn.microsoft.com/en-us/library/gg622941%28v=vs.85%29.aspx