Timeline for Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 25, 2023 at 3:27 | vote | accept | Dantre | ||
| Nov 23, 2023 at 12:30 | answer | added | Prem | timeline score: 4 | |
| Nov 23, 2023 at 10:59 | comment | added | rexkogitans | @Nayuki Empty files are not valid JPEG, PNG, ZIP, ... - anything which requires a header, be it binary or text - either. | |
| Nov 23, 2023 at 7:11 | comment | added | Bakuriu | There is a flaw in the scanner, not your code | |
| Nov 22, 2023 at 23:13 | comment | added | Joshua | I went looking to see if there was a correct content type for 204 responses, and I'm pretty sure there isn't one. Source: stackoverflow.com/questions/22326994/… | |
| Nov 22, 2023 at 21:42 | comment | added | Paŭlo Ebermann | @jcaron for successful POST/PUT/DELETE requests, a 204 response is common enough if there is no need to include any details. | |
| Nov 22, 2023 at 16:19 | answer | added | user3067860 | timeline score: 12 | |
| Nov 22, 2023 at 16:06 | comment | added | jcaron | Not arguing with the "204 should not need a Content-Type", but is there a specific reason you return a 204, rather than a 404 or 500 or some empty result (e.g. empty JSON array or empty XML of some sort)? I would expect quite a few clients to be... surprised if they received a 204 (and more generally any response without a content). | |
| S Nov 22, 2023 at 9:51 | history | suggested | Daniël van den Berg | CC BY-SA 4.0 |
Fixed a couple of typos.
|
| Nov 22, 2023 at 8:52 | comment | added | ruakh | Re: "There isn't even an appropriate content type for empty content": Pedantic note: there are multiple MIME types that can be appropriate for empty content (Content-Length 0); for example, both text/plain and application/octet-stream allow empty content. But HTTP 204 specifies no content, which makes it a bit icky (though harmless) to specify a Content-Type. | |
| Nov 22, 2023 at 6:31 | review | Suggested edits | |||
| S Nov 22, 2023 at 9:51 | |||||
| Nov 22, 2023 at 5:23 | comment | added | Nayuki | Note that <No Content> is not valid data for some content types. For example, the 0-byte file is not valid HTML, XML, nor JSON code. I can see why explicitly declaring a content type might be helpful. | |
| Nov 21, 2023 at 23:24 | history | became hot network question | |||
| Nov 21, 2023 at 17:00 | answer | added | Gh0stFish | timeline score: 41 | |
| S Nov 21, 2023 at 15:18 | review | First questions | |||
| Nov 21, 2023 at 19:29 | |||||
| S Nov 21, 2023 at 15:18 | history | asked | Dantre | CC BY-SA 4.0 |