Adopt the Content-Type header

[phax]

The existing Content-Type header with the form

Content-Type: multipart/related; boundary="----=_Part_0_899523303.1722602089777"; type="application/soap+xml"; charset=UTF-8

is not ideal in regards to OWASP rules:

• Rule 921421 (Dangerous Content-Type-Header)- see https://work.opsone.ch/mirror/owasp-modsecurity-crs/-/blob/main/rules/REQUEST-921-PROTOCOL-ATTACK.conf#L261
• Rule 920470 (Illegal Content-Type-Header) - see https://work.opsone.ch/mirror/owasp-modsecurity-crs/-/blob/main/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf#L971

Content-Type with lower score:

Content-Type: multipart/related; type="application/soap+xml"; boundary="example"; start="<ID of root MIME part>"; start-info="application/soap+xml"

and within first MIME part:

Content-Type: application/soap+xml; charset=UTF-8

[phax]

For v2.8.2 the charset parameter was removed from the main Content-Type; for the MIME part Content-Type the charset was already present.

Regarding the start parameter for multipart/related according to RFC 2387 chapter 3.2:

The start parameter, if given, is the content-ID of the compound object's "root". If not present the "root" is the first body part in the Multipart/Related entity. The "root" is the element the applications processes first.

As the main body part is ALWAYS the root, the start parameter is not needed.

Regarding the start-info parameter for multipart/related according to RFC 2387 chapter 3.3:

Additional information can be provided to an application by the start-info parameter. It contains either a string or points, via content-ID, to another MIME entity in the message. A typical use might be to provide additional command line parameters or a MIME entity giving auxiliary information for processing the compound object.
Applications that use Multipart/Related must specify the interpretation of start-info. User Agents shall provide the parameter's value to the processing application. Processes can distinguish a start-info reference from a token or quoted-string by examining the first non-white-space character, "<" indicates a reference.

As Applications that use Multipart/Related must specify the interpretation of start-info. is not the case for AS4, I decided to not use this parameter either.