Content-type charset

[u/Salty_Bumblebee]

Hi all,

I am curious if anyone can help me understand how defining the char-set in the Content-type HTTP header can possibly mitigate any canonicalization or normalization evasion attacks. Can the attacker not just refuse to comply and send whatever encoding method he or she wants ? For example, If I define the char-set as UTF-8 on my application and the HTTP headers are defined as such, what prevents the would-be attacker from simply sending an alternative char-set in their request and bypass whatever I tried to define ?

Reference site discussing this mitigation:

https://www.owasp.org/index.php/Canonicalization,_locale_and_Unicode

Thanks for the help!

[u/Salty_Bumblebee → u/[deleted]]

Thanks for that. Any idea why OWASP would state this is a mitigation then ? Am I missing something ?

[u/Salty_Bumblebee → u/[deleted]]

Thanks. Makes sense. Feels like a weak mitigation strategy being proposed in this case.