Content-Type header validated

Content-Type confusion attacks exploit the gap between what a server expects and what it receives. CWE-436 (Interpretation Conflict) captures the class: when a server parses a multipart form body as JSON, or an XML document through a JSON parser, unexpected behavior follows — from parser differentials enabling prototype pollution to content-sniffing attacks where the browser reinterprets a JSON response as HTML. OWASP API3 (Broken Object Property Level Authorization) and API6 both flag media type validation as a control boundary. APIs that accept arbitrary content types are vulnerable to parser-switching attacks where the attacker changes the Content-Type to trigger a different code path.

Validate Content-Type on all mutating requests before parsing the body. Return 415 Unsupported Media Type for unexpected types — don't silently parse or coerce.

// src/middleware.ts (Next.js)
export function middleware(req: NextRequest) {
  const method = req.method
  if (['POST', 'PUT', 'PATCH'].includes(method)) {
    const ct = req.headers.get('content-type') ?? ''
    if (!ct.startsWith('application/json')) {
      return new Response(
        JSON.stringify({ error: 'Content-Type must be application/json' }),
        { status: 415, headers: { 'Content-Type': 'application/json' } }
      )
    }
  }
  return NextResponse.next()
}

export const config = { matcher: '/api/:path*' }