I was recently asked by our security team to add x content type options no sniff to a site I was also recently handed over to. After adding it in, it seemed to cause issues with user log in as well as block purchases that have been made through the site. To my knowledge this only explicitly sets the content type to what it is set as on page load and shouldn't affect submission or log-in.
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="X-Content-Type-Options" value="nosniff" />
</customHeaders>
</httpProtocol>
</system.webServer>
I am looking at the pages as I did see this could possibly affect scripting but not seeing anywhere where it declares a content type. This is put into an old site that is written in VB.net