I have found in one of the client side libraries that it is performing an AJAX call to an API and checking if response contains all of the following headers with corresponding values (as a security measure):

    'content-type', 'application/json'
    'content-type', 'charset=utf-8'
    'X-Content-Type-Options', 'nosniff'
    'content-disposition', 'attachment'
    'X-Frame-Options', 'DENY'

If any header is not present, the library throws an exception. Is there a security reason to ever perform existence checks on HTTP headers?