title: How to avoid browser from rendering malacious content after the response is dispatched
body: <p>We are currently working on OWASP security fixes &amp; we identified one attack scenario for which we are trying to figure out a possible solution:</p>
  
  <ol>
  <li>User hits a valid HTTPRequest to our application. The URL in user's browser is set to our application url e.g. http(s)://www.abc.com/request</li>
  <li>Application processes the request and dispatches the response through Apache.</li>
  <li>While the response is en-route, an attacker intercepts the response and replaces the content of entire response with some malicious site or message like 'You Are Hacked!!'</li>
  <li>The response gets rendered in user's browser, with the URL still pointing to http(s)://www.abc.com/request in the browser but the content being malicious. This makes the user believe that it is still in our application.</li>
  </ol>
  
  <p>We could replicate this scenario through our proxy tool. Is there any way to identify &amp; prevent rendering such responses in the browser through Apache or custom HTTP headers? </p>
  
  <p>Any help/pointers will be highly appreciated.</p>
  
  <h2>added after first answer:</h2>
  
  <p>Consider one more scenario:</p>
  
  <ol>
  <li>User hits a valid HTTPRequest to our application.</li>
  <li>Attacker intercepts the request &amp; forwards it to some malicious site instead of our application. Here too, the URL in user's browser is set to application URL e.g. http(s)://www.abc.com/request but the content will be that of malicious site.</li>
  </ol>
  
  <p>This could also be possible with HTTPS.</p>
  
  <p>In scenario (2), while our website is HTTPS, the malicious website is plain HTTP. Hence, the certificate warning doesn't occur on the browser when the request is routed.</p>