Page Comparison

Validate "content types"

If you don’t validate "content type" you open up for injecting and execution of code

• Validate "content types" for incoming requests to your API

  • Reject requests that lack "content type", or contain unexpected "content type" values.
    Respond to such requests with HTTP status codes:

    • 406 - "Unacceptable"

    • 415 - "Unsupported Media Type"

  • Unngå uforvarende eksponering av content types som ikke er bruk ved å definere eksplisitte content types. Ved å  gjøre dette unngås angrep ved XXE.

  Svar med trygge content types

  • IKKE kopier "Accept" header til Avoid exposing content types not in use by defining explicit content types.
    By doing this you can avoid XXE (XML External Entity) attacks.

• Use safe content types in responses

  • DON'T copy the "Accept" header to the "Content-type" headeren til responsenIkke godta forespørselen dersom "Accept" headeren ikke inneholder en av de tillatte typene. Svar med HTTP statuskode of the response

  • Do not accept the request if the "Accept" header doesn’t contain type that is not allowed.
    Reply with HTTP status code 406 - "Not Acceptable" dersom typen angitt i if the type stated in the "Accept" headeren ikke er tillattheader is not allowed.

  • Sørg for at Make sure "content type" headere i din response headers in your responses stemmer overens  med innholdet i body.- F.eks application/json og ikke application/javascript