Header Validation

15 tests demonstrate Content-Type checking, required headers, and header injection prevention.

OpenAPI Configuration

Headers are defined in the OpenAPI specification with security requirements:

# openapi.yaml
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

paths:
  /users:
    post:
      security:
        - ApiKeyAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'

HEADER-001PASS

Valid Content-Type header

Sample Request

curl -X POST \
  -H "X-API-Key: valid-key-123" \
  -H "Content-Type: application/json" \
  -d '{"name": "John"}' \
  http://localhost:8080/users

Requests with correct Content-Type (application/json) matching the OpenAPI spec are processed.

HEADER-002BLOCKED

Missing required X-API-Key header

Sample Request

curl -X GET http://localhost:8080/users

Expected Response

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{"error": "Missing required header", "header": "X-API-Key"}

Requests without required authentication headers are rejected with 401 Unauthorized.

HEADER-003BLOCKED

Invalid Content-Type header

Sample Request

curl -X POST -H "X-API-Key: valid-key" \
  -H "Content-Type: text/xml" \
  -d 'John' \
  http://localhost:8080/users

Expected Response

HTTP/1.1 415 Unsupported Media Type

Content-Type must match what is defined in the OpenAPI spec. XML is rejected when only JSON is accepted.

HEADER-005BLOCKED

CRLF header injection attempt

Attack Attempt

curl -H $'X-Custom: value\r\nX-Injected: malicious' http://localhost:8080/users

Expected Response

HTTP/1.1 400 Bad Request

{"error": "Header injection detected", "code": "CRLF_INJECTION_BLOCKED"}

CRLF injection attempts in headers are detected and blocked to prevent HTTP response splitting attacks.

HEADER-008BLOCKED

SQL injection in header value

Attack Attempt

curl -H "X-API-Key: ' OR '1'='1" http://localhost:8080/users

SQL injection patterns in header values are detected and blocked.