I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?

  • What makes you think this could produce a security problem? What kind of application is parsing the answer?
    – A. Hersean
    Commented Jul 30, 2020 at 13:21
  • I read about the content sniffing attack, so I thought that it could be exploited here. The application is built in java servlet. Commented Jul 30, 2020 at 14:35
  • Even though the mime type could be wrongly deduced, there are no content here to exploit an potential vulnerability in the parser. At most one could make crash an extremely poorly written parser (usually empty content produce fail-safe behavior), but without content to control the execution flow, I fail to see how one could exploit this bug.
    – A. Hersean
    Commented Jul 30, 2020 at 14:48
  • @A.Hersean In a browser, content type mismatches can easily lead to XSS. For example, a server might send a JPG another user uploaded without further filtering; if the browser wrongly assumes that the content type is HTML, it will execute embedded javascript.
    – ManfP
    Commented Jul 30, 2020 at 23:44
  • @ManfP Yes of course. But HERE there cannot be "embedded javascript".
    – A. Hersean
    Commented Aug 3, 2020 at 8:08

2 Answers 2


A Content-Type header is applicable to a response with a body per RFC 2616:

When an entity-body is included with a message, the data type of that body is determined via the header fields Content-Type and Content- Encoding.

By extension, it's not necessary if there is no response body, as you're describing.

It is a SHOULD and not a MUST, so it is RFC-compliant to not include that header even if there is a response body:

Any HTTP/1.1 message containing an entity-body SHOULD include a
Content-Type header field defining the media type of that body.

As @Elhitch says, when the client has to guess what the Content-Type is, it's possible it will guess wrong with negative implications. But that doesn't apply to your use case of 'No content value (No response body)'.


Perhaps this article in the NetSparker knowledge base might be useful to you.

"[...] a missing Content-Type header which means that this website could be at risk of a MIME-sniffing attacks. [...] The problem arises once a website allows users to upload content which is then published on the web server. If an attacker can carry out XSS (Cross-site Scripting) attack by manipulating the content in a way to be accepted by the web application and rendered as HTML by the browser, it is possible to inject code in e.g. an image file and make the victim execute it by viewing the image.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .