Can somebody confirm me that the HTTP-XXS-protection header and the X-content-type header is useless in the case of a REST api who provide only json to clients ?
Can someone explain me why exaclty ? Thanks.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Those headers are of use to a compliant browser that can take action upon them.
API responses handled by a piece of code that parses them into something else will probably not be inspected for these headers or acted upon. However nothing stops browsers from doing API calls, against which these headers will come into play.
It is unusual that JSON content ends up being rendered directly on a browser, but it does happen. When it does, it is as critical to properly sanitise it as it if were any other piece of data.