HTTP Security Headers

Content-Type

Declares what a response actually is — HTML, JSON, an image — and its character encoding. A wrong or missing value causes both rendering bugs and real security issues.

What it is

Content-Type tells the recipient how to interpret the message body: its media (MIME) type and, for text formats, the character encoding. The browser uses it to decide whether to render HTML, parse JSON, display an image or offer a download. Because so much behavior keys off this header, an incorrect value causes both functional bugs and security problems.

Syntax & common types

text/html; charset=utf-8
HTML documents. Always declare the charset to avoid encoding-based XSS.
application/json
JSON API responses. charset is implicitly UTF-8.
text/css
Stylesheets. Required for a <link> stylesheet to apply under nosniff.
application/javascript
JavaScript. A script only runs under nosniff if served with a JS MIME type.
image/png, image/webp
Images.
application/octet-stream
Opaque binary; usually triggers a download.
HTTP RESPONSE HEADER
Content-Type: text/html; charset=utf-8

Declare charset for text

Omitting charset=utf-8 on HTML can let a browser guess an encoding (e.g. UTF-7 in old browsers), which has historically enabled charset-based XSS. Always declare UTF-8 explicitly.

Why it matters

  • Paired with X-Content-Type-Options: nosniff, a correct Content-Type is what makes scripts and styles load and prevents type-confusion attacks.
  • A missing or wrong charset on HTML can enable encoding-based cross-site scripting.
  • Serving user content with an executable Content-Type (e.g. text/html for an uploaded file) can turn a benign upload into stored XSS.

Common mistakes

  • Serving JSON as text/html, which can cause a browser to render attacker-controlled JSON as HTML.
  • Omitting charset=utf-8 on text responses and relying on the browser to guess.
  • Returning user-uploaded files with a type the browser will execute or render, instead of a safe download type.
  • Mislabeling a stylesheet or script so that under nosniff it silently fails to load.

How WebInspect checks this

  • WebInspect reports the response Content-Type and whether a charset is declared for text formats.
  • It correlates the declared type with X-Content-Type-Options: nosniff to surface type-confusion risk.
  • It flags text/HTML responses lacking an explicit UTF-8 charset.