Profile My skills Saved Collections Edit profile Submit a skill

Missing or Incorrect Content-Type Validation

Detects API endpoints that do not validate or enforce Content-Type headers, enabling MIME-type confusion and CSRF attacks.

zakirkun 7da7402 2 files · 2.0 KB Updated
Integrations & APIs

File contents

Missing Content-Type Validation

Overview

APIs that accept requests without validating Content-Type are vulnerable to:

  • CSRF: Browser forms submit as application/x-www-form-urlencoded which HTML forms can send cross-origin
  • Content confusion: Unexpected parsing if body is mismatched with Content-Type
  • Polyglot attacks: Content that is valid as multiple types

Modern CSRF protection relies on the browser's cross-origin restriction on JSON Content-Type.

Remediation

  • Validate Content-Type for all POST/PUT/PATCH endpoints
  • Reject requests with unexpected Content-Type
  • Use CSRF tokens even for JSON APIs as defense-in-depth

zakirkun/ice-tea/tree/main/skills/api/content-type-missing commit 7da7402614

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/missing-or-incorrect-content-type-validation