The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS? This is a language neutral question, it can be Java,PHP,ASP,Node,Python, etc.

The X-Content-Type-Options: nosniff is not set.

If XSS is still possible, please share some research/explanation on it.

  • This isn't enough context to give you a proper answer. What happens with the JSON response? How is it processed?
    – Ja1024
    Commented Jun 14, 2023 at 20:38

1 Answer 1


The rest of this answer assumes that you have extensive or even complete control over the "JSON" response. That is, you can inject arbitrary characters (in particular HTML meta-characters) into the response, ideally into arbitrary positions within the response. If you can't do that (for example, if < and > characters in the JSON are escaped using hex-encoding) then none of the rest of this is going to work.

Even if you can control the response content entirely, most modern browsers perform little if any MIME sniffing. Firefox in particular treats top-level documents as though they are always set with X-Content-Type-Options: nosniff set, and all modern browsers are familiar with JSON and not that likely to try rendering it as HTML (which is necessary for an attack of this type).

You're also trying to exploit non-standardized behavior in the browser, which is going to vary between browsers and versions. Even if I had to hand a table of known MIME-sniffing vectors for JSON on modern browsers, it could be out of date by tomorrow as there's nothing preventing a browser vendor from changing this (non-standardized) behavior.

With that said, here are some things that might trigger MIME sniffing in some browsers:

  • Send a top-level element of <HTML> or otherwise make the start of the page look as HTML-esque as possible.
  • Serve a page that has the extension .htm or .html or similar. The browser is more likely to think that the server is confused if it sees such an extension.
  • Try both very strict adherence to an HTML spec, and very sloppy (unclosed elements, missing root element, etc.). If there's a reliable way to force a browser into quirks mode, do that.
  • For Firefox (and possibly other Gecko-powered browsers) in particular, serve the page in a child window context (iframe, window.open, etc.) to bypass the "top level pages are treated as always being nosniff thing.
  • Make sure to try all browsers a user might be using. Safari is meaningfully different from Chrome, and even though Edge and Opera pretty much aren't, try them too. Firefox is obviously it's own thing. If the site caters to legacy users at all, try IE and/or pre-Blink Edge, and possibly similarly dated versions of browsers. Try both desktop and mobile browsers. Site compatibility testing tools might be helpful here, for pointing a lot of browsers at a URL.

In general, I wouldn't expect this to work with a modern browser, but it might work on one of them. I expect it would work on IE, even IE11, and pre-Blink versions of Edge seem pretty likely too.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .