3 ms·
Why would Twitter send a Content-Disposition header with their API responses? content-disposition: attachment; filename=json.json
by gav 7y ago
Why would Twitter send a Content-Disposition header with their API responses?
content-disposition: attachment; filename=json.json
- r1ch 7y agoI believe this is for additional XSS protection - if a user clicks a suspicious API link, the worst that happens is the browser downloads a json.json file instead of rendering a potentially malicious payload.
- anamexis 7y agoHow would rendering the file perform a malicious action?
- tambre 7y agoThrough a bug in the renderer that the file exploits.
- chias 7y agoIf the content-type header failed to get sent, or if a browser (lookin' at you, IE) chooses to ignore it in favor of what it thinks it probably should have been, then the result can get rendered as HTML. If you have some json that has angle-brackets in it (which, being JSON, would obviously not be HTML-escaped) and the result is rendered as HTML, this can result in your browser executing attacker-defined javascript in Twitter's origin. Sending it as a "file download" has no effect on what happens when the endpoint is called via AJAX, but in the event that a browser navigates to it directly, ensures that even the dumbest of browsers do not render it as HTML.
- deleted 7y ago[deleted]
- danb232 7y agobecause you can legitimately download your direct message history.