Skip to main content

Insecure or unset HTTP headers - X-Content-Type-Options

Need​

Enforcement of secure content type options

Context​

  • Usage of Java for building cross-platform applications
  • Usage of HttpServletResponse for handling HTTP responses in Java Servlets

Description​

Non compliant code​

import javax.servlet.http.HttpServletResponse;

public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
    // other code

    res.setContentType("text/html");
    res.getWriter().write("<html><body>Hello World!</body></html>");
}

In the above code, we are setting the Content-Type of the HTTP response to text/html and then we are writing an HTML string to the response. This is a typical pattern in servlet-based Java applications.

However, the code is missing an important HTTP header: X-Content-Type-Options. This header is used to protect against MIME type confusion attacks. When set to nosniff, it prevents the browser from trying to interpret the content as something other than the declared content type.

Without this header, if a user can somehow upload malicious content to your server, and then trick another user into requesting that content, the user's browser might interpret the content as executable JavaScript, even if the Content-Type is set to text/html. This can lead to serious security vulnerabilities, like Cross-Site Scripting (XSS) attacks.

In this case, the vulnerability lies in the absence of the X-Content-Type-Options HTTP header in the response sent from the server to the client's browser.

Steps​

  • Set the X-Content-Type-Options HTTP header in the server response
  • Set the value of the X-Content-Type-Options header to 'nosniff'
  • Ensure that the X-Content-Type-Options header is set for all responses, not just HTML responses

Compliant code​

import javax.servlet.http.HttpServletResponse;

public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
    // other code

    res.setContentType("text/html");
    res.setHeader("X-Content-Type-Options", "nosniff");
    res.getWriter().write("<html><body>Hello World!</body></html>");
}

The above code fixes the vulnerability by setting the X-Content-Type-Options HTTP header to 'nosniff'. This header is a security feature that helps prevent attacks based on MIME-type confusion. The 'nosniff' option prevents the browser from trying to interpret content differently from the declared content-type.

The setHeader method is used to set the X-Content-Type-Options header. The first argument is the name of the header, and the second argument is the value of the header. In this case, we set the value to 'nosniff' to instruct the browser not to try to interpret the content type.

This fix ensures that the X-Content-Type-Options header is set for all responses, not just HTML responses, which helps to prevent potential security vulnerabilities.

References​

Last updated on