The recommended content-headers are:
Content-Type: application/json
X-Content-Type-Options: nosniff
Content-Disposition: attachment
Why are these important? The JSON data provided by the CSP is intended to be incorporated into automated processes by the FedRAMP PMO and Agency customers. Since the data is going to flow into agency systems we want to do everything possible to make sure the JSON cannot become an attack vector against an agency customer. Modern browsers and http client packages will see the Content-Type: application/json header and will refuse to execute any code included in the data stream. Without this header the client may interpret the data as code and attempt to process or execute it in an unsafe way. Similarly the X-Content-Type-Options: nosniff header tells the client not to inspect the content which can potentially lead to the client overriding the content-type header or exploitation of other vulnerabilities. Finally, Content-Disposition: attachment tells web browsers specifically to treat this as a downloadable file and not to try and render the file in the browser. This protects against a wide range of XSS attacks.
The importance of adding these content-headers is a prime example of how the 20x security philosophy works. AT first glance we may be tempted to dismiss the risk posed by these JSON files. After all, they are generated by the CSP and the whole point of FedRAMP is to trust the CSP, right? But remember that the intent is that these files are being generated automatically by complex processes running in multiple parts of the CSP environment. Potentially including some parts that are outside the minimum assessment scope. Add to that the fact that the files are likely being ingested to sensitive agency information systems by multiple agencies. There is a lot of value in delivering machine readable files that support automation, but when we look at the implementation we see there is also some risk created. The risk of an adversary compromising a CSP’s process and generating a malicious JSON file may be small, but the potential impact could be to compromise multiple agency systems across the government. Given the low cost of implementing proper content-type headers and the significant reduction in risk requiring these headers from all CSPs is the obvious choice.
