dont-sniff-mimetype

import express from 'express'; import dontSniffMimetype from 'dont-sniff-mimetype'; const app = express(); // Apply the X-Content-Type-Options: nosniff header to all responses app.use(dontSniffMimetype()); app.get('/', (req, res) => { res.set('Content-Type', 'text/html'); res.send('<h1>Hello! MIME sniffing is prevented.</h1><script>console.log("This script runs because it's HTML, but if a JS file was served as text/plain, it would be blocked.");</script>'); }); app.get('/untrusted.txt', (req, res) => { // Serve a 'text' file that looks like JavaScript, but is explicitly text/plain // With 'nosniff', browsers will not execute this as script. res.set('Content-Type', 'text/plain'); res.send('alert("This should not execute as JavaScript!"); console.log("MIME sniffed prevented for untrusted.txt");'); }); app.listen(3000, () => { console.log('Server running on http://localhost:3000'); console.log('Visit / to see HTML. Visit /untrusted.txt and check headers/console.'); });