OWASPASVS 5.0 requirement
ASVS-V4.1.1 Every http response with a message body contains a content-type header field that matches the actual content of the response, including the…
- Standard
- OWASP ASVS 5.0
- Chapter
- V4 API and Web Service
- Section
- V4.1 Generic Web Service Security
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that every HTTP response with a message body contains a Content-Type header field that matches the actual content of the response, including the charset parameter to specify safe character encoding (e.g., UTF-8, ISO-8859-1) according to IANA Media Types, such as "text/", "/+xml" and "/xml".