I have found in one of the client side libraries that it is checking if response contains all of the following headers with corresponding values (as a security measure):

    'content-type', 'application/json'
    'content-type', 'charset=utf-8'
    'X-Content-Type-Options', 'nosniff'
    'content-disposition', 'attachment'
    'X-Frame-Options', 'DENY'

I cannot see a reason for how it can help with security by validating those by client side library.

Anyone has an idea if this is reasonable or does not make any sense?

P.S. This is not a question of whether these headers should be set by the server.

P.P.S. I have found this out since for some reason even if the header is present I can see in logs that sometimes this exception is thrown. I don't really know why, but I suppose either proxies removing headers or some browsers removing/not returning it in js for some reason. I'd be glad to hear why if someone knows reason.