Can somebody confirm me that the HTTP-XXS-protection header and the X-content-type header is useless in the case of a REST api who provide only json to clients ?

Can someone explain me why exaclty ? Thanks.


1 Answer 1


Those headers are of use to a compliant browser that can take action upon them.

API responses handled by a piece of code that parses them into something else will probably not be inspected for these headers or acted upon. However nothing stops browsers from doing API calls, against which these headers will come into play.

It is unusual that JSON content ends up being rendered directly on a browser, but it does happen. When it does, it is as critical to properly sanitise it as it if were any other piece of data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .