为什么要验证REST请求中的内容类型标头

Question

The OWASP website suggest to validate the content-type header. But it does not specify the rational for the same. What is the reason that I should validate the content-type header, even though I am not reading or using it?

When POSTing or PUTting new data, the client will specify the Content-Type (eg application/xml or application/json) of the incoming data. The server should never assume the Content-Type; it should always check that the Content-Type header and the content are the same type. A lack of Content-Type header or an unexpected Content-Type header should result in the server rejecting the content with a 406 Not Acceptable response.

Answer 1

One example that comes to mind is in a cross-site ajax request, it is easy to send a text/html request which will not generate a pre-flight request, but it is not possible with applictaion/json . So if you have a service with a POST action that expects json and changes server state, it may be possible to exploit CSRF if text/html is accepted for the content type, but there is some basic protection if application/json is verified, because the browser will not send the request from a different domain if the response to the pre-flight does not explicitly allow a CORS post.

So some properties of cross-domain ajax requests depend on the content type. I think this may be the main reason.

Also from a more theoretical standpoint, the format of the data is needed to parse it. I cannot think of an actual exploit, but at least in theory, trying to parse data in a wrong format may lead to the wrong results, things parsed different from what they were supposed to be. It's best to just validate that the client is actually sending what it claims, and what it should be.