easy5 pts · first answer countsweb-securityxsshttp-headers

JSON served as text/html

An API returns user-controlled JSON with Content-Type: text/html. Why is that a risk?

A.JSON parsers reject the text/html typeB.It switches off gzip compression for the replyC.It breaks CORS for every caller of the APID.Opened directly, the browser may render it as a page

Discussion 0

Join free to post in the discussion.

JSON served as text/html

Discussion 0

Related questions