Content-Type & X-Content-Type-Options Auditor

Fetches one public URL and inspects its Content-Type header, X-Content-Type-Options header, and magic-byte sniff to detect MIME confusion risk. Returns a readiness score and recommendations. Built for security teams, devops engineers, site migration QA, and frontend platform teams.

Use cases

• Verify X-Content-Type-Options: nosniff on static assets after a CDN or origin cutover.
• Detect script or stylesheet responses with a Content-Type that disagrees with the actual bytes.
• Catch missing or generic Content-Type headers (e.g. application/octet-stream on a JS file) before production deploy.
• Run scheduled checks on critical resources to catch configuration drift on edge servers.
• Feed structured results into security QA dashboards or CI pipelines.

Input

Field	Type	Description
startUrl	string	Public HTTP or HTTPS URL to audit. URLs with credentials and private network targets are rejected.
timeoutSeconds	integer	Request timeout from 3 to 30 seconds. Defaults to 10.
maxBodyBytes	integer	Maximum response body bytes to read for magic-byte sniffing. Defaults to 64 KB; capped at 512 KB.

Output

The actor pushes one dataset item per run.

Field	Type	Description
inputUrl	string	Original URL from input.
normalizedInputUrl	string	Normalized input URL after defaulting the scheme.
finalUrl	string	Final page URL after redirects.
ok	boolean	True when the fetch succeeded.
checkedAt	string	ISO timestamp for the audit.
httpStatus	integer or null	HTTP status code from the response.
declaredContentType	string or null	Raw Content-Type header value.
declaredType	string or null	Parsed media type (lowercased, without parameters).
declaredCharset	string or null	Charset from the Content-Type header, if present.
xContentTypeOptions	string or null	Raw X-Content-Type-Options header value.
hasNosniff	boolean	True when X-Content-Type-Options contains nosniff.
sniffedType	string or null	Magic-byte sniffed media type, or null if unrecognized.
typeMismatch	boolean	True when the sniffed type conflicts with the declared Content-Type.
confusionRisk	string	MIME confusion risk level: low, medium, or critical.
score	integer	Content-Type readiness score from 0 to 100.
grade	string	Letter grade from A to F.
issues	array	Human-readable issues.
recommendations	array	Suggested fixes.
error	string or null	Fetch-level error, if the request failed.

Example input

{
  "startUrl": "https://example.com/app.js",
  "timeoutSeconds": 10
}

Example output

{
  "inputUrl": "https://example.com/app.js",
  "normalizedInputUrl": "https://example.com/app.js",
  "finalUrl": "https://example.com/app.js",
  "ok": true,
  "checkedAt": "2025-01-01T00:00:00.000Z",
  "httpStatus": 200,
  "declaredContentType": "application/javascript; charset=utf-8",
  "declaredType": "application/javascript",
  "declaredCharset": "utf-8",
  "xContentTypeOptions": "nosniff",
  "hasNosniff": true,
  "sniffedType": null,
  "typeMismatch": false,
  "confusionRisk": "low",
  "score": 100,
  "grade": "A",
  "issues": [],
  "recommendations": [
    "Content-Type declaration, charset, and X-Content-Type-Options look correct for this resource."
  ],
  "error": null
}

Security

• Only public HTTP and HTTPS URLs are fetched.
• URLs with usernames or passwords are rejected.
• Private IPv4, private IPv6, localhost, link-local, and private DNS resolutions are blocked before fetching.
• Redirect destinations are revalidated before they are followed.
• Body reads are capped to limit memory use during magic-byte sniffing.
• The actor does not require logins, cookies, browser sessions, or credentials.

Pricing

Event	Suggested price
Actor start	$0.005
URL audited	$0.01

Suggested launch price: about $0.015 per audited URL. Teams can schedule the actor for recurring checks on important resources after deploys and CDN cutovers.

FAQ

Does this actor crawl multiple URLs or a whole site?

No. It fetches one URL per run. This keeps runs cheap and predictable for CI and scheduled monitoring.

How does the magic-byte sniff work?

The actor reads the first bytes of the response body and compares them against known file signatures (image, PDF, gzip, WOFF fonts, etc.). It also checks text prefixes for HTML, JSON, XML, and SVG. If the sniffed type disagrees with the declared Content-Type, the actor flags a mismatch.

What makes a risk critical?

A type mismatch on a script or stylesheet resource without X-Content-Type-Options: nosniff is critical, because browsers may execute content with a different type than intended, creating a MIME-sniffing attack vector.

Why is X-Content-Type-Options important?

Without nosniff, browsers may sniff the response body and interpret it as a different type than declared in the Content-Type header. For scripts and stylesheets, this can allow cross-site script execution. nosniff instructs the browser to respect the declared type.

How does the score work?

The score starts at 100 and is reduced for: missing nosniff (-10, -30 for scripts/stylesheets), missing Content-Type (-25), generic application/octet-stream with detectable bytes (-10), type mismatch (-15, -35 for scripts/stylesheets), and missing charset on HTML (-5). The resulting letter grade reflects overall Content-Type posture.