I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security measure):

'content-type', 'application/json'
'content-type', 'charset=utf-8'
'X-Content-Type-Options', 'nosniff'
'content-disposition', 'attachment'
'X-Frame-Options', 'DENY'

If one header is not present, the library throws an exception.

I cannot see a reason for how it can help with security by validating those by client side library.

Anyone has an idea if this is reasonable or does not make any sense?

P.S. This is not a question of whether these headers should be set by the server.

P.P.S. I have found this out since for some reason even if the header is present I can see in logs that sometimes this exception is thrown for the X-... headers. I don't really know why, but I suppose either proxies removing headers or some browsers removing/not returning it in js for some reason. I'd be glad to hear why if someone knows reason.

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security measure):

'content-type', 'application/json'
'content-type', 'charset=utf-8'
'X-Content-Type-Options', 'nosniff'
'content-disposition', 'attachment'
'X-Frame-Options', 'DENY'

If any header is not present, the library throws an exception. Is there a security reason to ever perform existence checks on HTTP headers?

I have found in one of the client side libraries that it is checking if response contains all of the following headers with corresponding values (as a security measure):

'content-type', 'application/json'
'content-type', 'charset=utf-8'
'X-Content-Type-Options', 'nosniff'
'content-disposition', 'attachment'
'X-Frame-Options', 'DENY'

If one header is not present, the library throws an exception.

I cannot see a reason for how it can help with security by validating those by client side library.

Anyone has an idea if this is reasonable or does not make any sense?

P.S. This is not a question of whether these headers should be set by the server.

P.P.S. I have found this out since for some reason even if the header is present I can see in logs that sometimes this exception is thrown for the X-... headers. I don't really know why, but I suppose either proxies removing headers or some browsers removing/not returning it in js for some reason. I'd be glad to hear why if someone knows reason.

I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security measure):

'content-type', 'application/json'
'content-type', 'charset=utf-8'
'X-Content-Type-Options', 'nosniff'
'content-disposition', 'attachment'
'X-Frame-Options', 'DENY'

If one header is not present, the library throws an exception.

I cannot see a reason for how it can help with security by validating those by client side library.

Anyone has an idea if this is reasonable or does not make any sense?

P.S. This is not a question of whether these headers should be set by the server.

P.P.S. I have found this out since for some reason even if the header is present I can see in logs that sometimes this exception is thrown for the X-... headers. I don't really know why, but I suppose either proxies removing headers or some browsers removing/not returning it in js for some reason. I'd be glad to hear why if someone knows reason.

I have found in one of the client side libraries that it is checking if response contains all of the following headers with corresponding values (as a security measure):

'content-type', 'application/json'
'content-type', 'charset=utf-8'
'X-Content-Type-Options', 'nosniff'
'content-disposition', 'attachment'
'X-Frame-Options', 'DENY'

If one header is not present, the library throws an exception.

I cannot see a reason for how it can help with security by validating those by client side library.

Anyone has an idea if this is reasonable or does not make any sense?

P.S. This is not a question of whether these headers should be set by the server.

P.P.S. I have found this out since for some reason even if the header is present I can see in logs that sometimes this exception is thrown. I don't really know why, but I suppose either proxies removing headers or some browsers removing/not returning it in js for some reason. I'd be glad to hear why if someone knows reason.

I have found in one of the client side libraries that it is checking if response contains all of the following headers with corresponding values (as a security measure):

'content-type', 'application/json'
'content-type', 'charset=utf-8'
'X-Content-Type-Options', 'nosniff'
'content-disposition', 'attachment'
'X-Frame-Options', 'DENY'

If one header is not present, the library throws an exception.

I cannot see a reason for how it can help with security by validating those by client side library.

Anyone has an idea if this is reasonable or does not make any sense?

P.S. This is not a question of whether these headers should be set by the server.

P.P.S. I have found this out since for some reason even if the header is present I can see in logs that sometimes this exception is thrown for the X-... headers. I don't really know why, but I suppose either proxies removing headers or some browsers removing/not returning it in js for some reason. I'd be glad to hear why if someone knows reason.