Insecure Content-Type Setting about websocket

Posted on

We have a web app (GWT) and deploy in JBoss EAP 7.1, and user use WebInspect to scan this web app, then they found a issue as attached images with websocket URL
ws://10.4.202.26:8460/ealing/JBoss7WebsocketServlet
issue summary 1
issue summary 2

We just have WAR file, we don't have java source codes.
source code

It seems like there's no "Content-Type" header.
Is there any jboss server config setting for fix that ?
Or should it be not a real vulnerability ?

Many thx.

CL

Responses