Insecure or unset HTTP headers - Accept
Description
The application does not set the Accept header or allows any MIME type in the requests. An attacker could abuse this feature to cause unexpected behaviors when the application interprets incorrect content-types.
Impact
Lead to unexpected behaviors due to content type misinterpretations.
Recommendation
- Set the Accept Header in client requests. - Define explicitly the allowed content types for the application. - Deny all request that contain a content type different from the expected by the application.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
⏱️ 30 minutes.