Content type is not specified
Summary: PortSwigger Research describes how browsers, when a response lacks a Content-type header, usually analyze the response body and attempt to determine its MIME type themselves. That behavior can produce unexpected results, and if the content contains user-controllable data it may lead to cross-site scripting or other client-side vulnerabilities.
Key Takeaway: PortSwigger notes that in most cases a missing content type is not a security flaw, particularly for static content, so the exposure depends on whether user-controllable data sits in a response whose type the browser has to guess.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026