Direct answer
An API should parse only the formats its contract supports and apply equivalent validation to each accepted representation. A content type declared by a client is a claim, not proof that the body matches it.
Map the supported contract
Identify the test endpoint, allowed request media types, expected response types and application owners. Choose a harmless operation with synthetic input and document how unsupported or malformed input should be rejected.
Reference: OWASP REST Security Cheat Sheet.
Compare normal and mismatched requests
Send a valid request in the documented format as a positive control. Then send a small harmless body with a mismatched or unsupported content type and observe the response and final state. Do not send large payloads or change production records.
- Record the exact media type and response status.
- Test each intentionally supported parser separately.
- Protect tokens and synthetic account identifiers in evidence.
Review parser boundaries
If a proxy validates JSON but an application also accepts another format, confirm the same authorization and validation apply to both. A different error message alone does not prove a bypass; demonstrate any actual policy mismatch using the agreed fixture.
Retest clients and errors
After a correction, repeat the allowed and rejected formats and verify legitimate clients still work. Check that errors are useful without exposing stack traces, internal paths or sensitive request data.
Assessment limits
Content-type checks are one layer of input handling and do not establish that every field or parser is safe. A finite set of requests cannot cover all API routes and representations.
Frequently asked questions
Does a JSON Content-Type guarantee the body is valid JSON?
No. The server must parse and validate the body rather than trusting the declared header.
Should every non-JSON request fail?
Only if the API contract does not support it. Intentionally supported formats need their own consistent validation and authorization.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.