In 2.11, there was a change to introduce a SecurityResponse wrapper around a BytesRestResponse. In the method to cast the SecurityResponse to a RestResponse, the method creates a BytesRestResponse using the constructor without contentType. (Here's the BytesResponseResponse constructor for context). Even if an instance of SecurityResponse is created with a Content-Type header it is being ignored since the constructor of BytesRestResponse will set it at the time the RestResponse is instantiated.
APIs impacted:
/_plugins/security/api/authtoken- Any Unauthed call now responds with
application/json instead of text/plain
In 2.11, there was a change to introduce a SecurityResponse wrapper around a BytesRestResponse. In the method to cast the SecurityResponse to a RestResponse, the method creates a BytesRestResponse using the constructor without contentType. (Here's the BytesResponseResponse constructor for context). Even if an instance of SecurityResponse is created with a Content-Type header it is being ignored since the constructor of BytesRestResponse will set it at the time the RestResponse is instantiated.
APIs impacted:
/_plugins/security/api/authtokenapplication/jsoninstead oftext/plain