Security Test: Content-Type header¶

Description¶

Default Severity: low

When a response is sent without a correctly set Content-Type header, browsers might guess the file type incorrectly. This misinterpretation can let attackers trick the browser into treating data as a different type than intended—sometimes even as executable code. The risk is that if harmful content is misclassified, it could lead to issues like cross-site scripting attacks or other forms of code injection. Developers often overlook setting or validating this header, relying on the browser to make the correct guess, which can create security gaps and unintended behavior if an attacker manipulates the content.

Configuration¶

Identifier: protocol/header_content_type

Examples¶

All configuration available:

checks:
  protocol/header_content_type:
    skip: false # default

Compliance and Standards¶