enhance http calls to OP to check content-type on response for json DuendeArchive#488

Author: brockallen

dist/oidc-client.js

@@ -26,12 +26,18 @@ export class JsonService {
                 Log.debug("HTTP response received, status", req.status);
 
                 if (req.status === 200) {
-                    try {
-                        resolve(JSON.parse(req.responseText));
+                    var contentType = req.getResponseHeader("Content-Type");
+                    if (contentType && contentType.startsWith("application/json")) {
+                        try {
+                            resolve(JSON.parse(req.responseText));
+                        }
+                        catch (e) {
+                            Log.error("Error parsing JSON response", e.message);
+                            reject(e);
+                        }
                     }
-                    catch (e) {
-                        Log.error("Error parsing JSON response", e.message);
-                        reject(e);
+                    else {
+                        reject(Error("Invalid response Content-Type: " + contentType + ", from URL: " + url));
                     }
                 }
                 else {

dist/oidc-client.min.js

@@ -60,6 +60,7 @@ describe("JsonService", function() {
             });
 
             stubHttpRequest.status = 200;
+            stubHttpRequest.responseHeaders.set('Content-Type', 'application/json');
             stubHttpRequest.responseText = JSON.stringify({foo:1, bar:'test'});
             stubHttpRequest.onload();
         });
@@ -94,12 +95,30 @@ describe("JsonService", function() {
 
             stubHttpRequest.onerror();
         });
+
+        it("should reject promise when http response content type is not json", function(done) {
+            let p = subject.getJson("http://test");
+
+            p.then(result => {
+                assert.fail();
+            }, error => {
+                error.should.be.instanceof(Error);
+                error.message.indexOf('text/html').should.be.above(-1);
+                done();
+            });
+
+            stubHttpRequest.status = 200;
+            stubHttpRequest.responseHeaders.set('Content-Type', 'text/html');
+            stubHttpRequest.responseText = JSON.stringify({foo:1, bar:'test'});
+            stubHttpRequest.onload();
+        });
     });
 });
 
 class StubXMLHttpRequest {
     constructor() {
         this.headers = new Map();
+        this.responseHeaders = new Map();
     }
 
     open(method, url) {
@@ -111,6 +130,10 @@ class StubXMLHttpRequest {
         this.headers.set(header, value);
     }
 
+    getResponseHeader(name){
+        return this.responseHeaders.get(name);
+    }
+
     send() {
     }
 }