2 edited body
source | link

Set the Content-Type to application/json, and set X-Content-Type-Options: nosniff (the last header instructs the browser to use the given content-type - no extra guessing). You could even considefconsider adding a Content-Disposition: attachment header. This will be ignored by XHR requests, but cause the download dialog to pop if an attacker tries to trick a user into opening it directly in the browser.

You could also have a look at: http://erlend.oftedal.no/blog/?blogid=127 and http://erlend.oftedal.no/blog/?blogid=134

Set the Content-Type to application/json, and set X-Content-Type-Options: nosniff (the last header instructs the browser to use the given content-type - no extra guessing). You could even considef adding a Content-Disposition: attachment header. This will be ignored by XHR requests, but cause the download dialog to pop if an attacker tries to trick a user into opening it directly in the browser.

You could also have a look at: http://erlend.oftedal.no/blog/?blogid=127 and http://erlend.oftedal.no/blog/?blogid=134

Set the Content-Type to application/json, and set X-Content-Type-Options: nosniff (the last header instructs the browser to use the given content-type - no extra guessing). You could even consider adding a Content-Disposition: attachment header. This will be ignored by XHR requests, but cause the download dialog to pop if an attacker tries to trick a user into opening it directly in the browser.

You could also have a look at: http://erlend.oftedal.no/blog/?blogid=127 and http://erlend.oftedal.no/blog/?blogid=134

1
source | link

Set the Content-Type to application/json, and set X-Content-Type-Options: nosniff (the last header instructs the browser to use the given content-type - no extra guessing). You could even considef adding a Content-Disposition: attachment header. This will be ignored by XHR requests, but cause the download dialog to pop if an attacker tries to trick a user into opening it directly in the browser.

You could also have a look at: http://erlend.oftedal.no/blog/?blogid=127 and http://erlend.oftedal.no/blog/?blogid=134