Security Headers

HTTP Security Headers are a subset of HTTP headers that enhance the security of web applications against common web vulnerabilities by controlling how browsers behave when handling responses from your server.

Header	Description
Content-Security-Policy	Specifies the origin of content that is allowed to be loaded. It helps against injection attacks, such as XSS (deprecated ).
Strict-Transport-Security	Informs browsers that the web application should only be accessed using HTTPS and not HTTP.
Content-Type	Indicates the resource's original media type.
X-Content-Type-Options	Indicates to the browsers that the MIME types advertised in the Content-Type headers should be followed and not guessed (MIME sniffing).
Referrer-Policy	Controls how much referrer information (sent via the Referer header) should be included with requests.
Set-Cookie	Sends a cookie from the server to the user agent, so the user agent can send it back to the server later. It is not a security header per se, but its security attributes are crucial.
X-Frame-Options	Prevents other websites from loading the page in an iframe (clickjacking attacks). XFO is only useful when there is something interactive on the response, such as links, buttons, etc. Can be replaced by CSP's frame-ancestors directive.
Clear-Site-Data	It clears browsing data (cookies, storage, cache) associated with the requesting website. Useful on logout functionalities.
Cache-Control	It holds directives for caching in both requests and responses.
Cross-Origin-Opener-Policy	COOP ensures that a top-level document does not share a browsing context group with cross-origin documents.
Cross-Origin-Embedder-Policy	COEP prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
Cross-Origin-Resource-Policy	CORP controls the set of origins that are empowered to include a resource.
X-Permitted-Cross-Domain-Policies	A cross-domain policy file is an XML document that grants a web client permission to handle data across domains.
X-XSS-Protection	Deprecated by .

We can check the Security headers of a public website online using an application such as the Security Header Check.

• An excellent demo of a clickjacking attack & how X-Frame-Options can prevent it.

• A nice article about MIME sniffing.

Resources

OWASP CheatSheet

HTTP Headers - OWASP Cheat Sheet Series

OSHP

OWASP Secure Headers Project | OWASP Foundation

Lecture

Darkrelay Guide

HTTP Security Headers: A complete guide to HTTP headersDARKRELAY