1

I am working through a report of an automated vulnerability scanner. One Item is

Web Server Misconfiguration: Insecure Content-Type Setting ( 11359 )

It's about not returning the character-set for a given HTML page like so, for example:

HTTP/1.1 200 OK
...
Content-Type: text/html; charset=utf-8
...

the reported response in question only gives

HTTP/1.1 200 OK
...
Content-Type: text/html
...

Now I understand the implications, but what about CSS and especially JavaScript?

Is the charset of CSS and JavaScript resources strictly defined by a standard?

What if I have internationalized strings in JavaScript variables? Will those by definition have to be escaped? Or would this case require the declaration of a charset?

2

Is the charset of CSS and JavaScript resources strictly defined by a standard?

No. It is similarly flexible as with HTML, i.e. can be defined in the style itself, by the embedding HTML or in the HTTP header or even with a byte order mark. If not explicitly defined it might also have a default or might depend on the charset encoding of the embedding document:

@charset "UTF-8";
<link rel="stylesheet" type="text/css" charset="utf-8" ...>
Content-Type: text/css; charset=utf-8

And the same is true for JavaScript. Thus, you better always specify the charset encoding.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.