That you change the Content-Type of a page based on the URL is quite a vulnerability on itself no? I don't think browsers infer meaning about file types based

That you change the Content-Type of a page based on the URL is quite a vulnerability on itself no? I don't think browsers infer meaning about file types based on the URL. The Content-Type is always what is being used. If you have backend side code that maps URLs Content-Type header mime types. Don't. Instead simply always return text/html for user profiles. Then the extension shouldn't matter.