格 千格 KiloCell

Security Headers Reference

A detailed HTTP Security Response Header Reference Dictionary. Helps you build a modern security-compliant Web application.

Why do you need a complete HTTP header list?

In modern Web In development, security is no longer a back-end code issue. The browser provides a large number of built-in security switches as a complex running-time environment. Most of these switches pass. HTTP Response Header (Response) Headers) to control. A standard “security check” usually finds that most websites only open the most basic head, ignoring resistance. Over 90% of the high-level features of the XSS and hijacking attacks.

Defense depth: not just firewalls

Many developers think that it's all good to have Web-based firewalls. However, WAF Only filter requests, while the secure head creates the last line of defence at the user ' s browser end. For example:

  • CSP The execution of the script could be prevented after the attackers had successfully injected it into the malicious script.
  • HSTS You can use the user to accidentally click on the HTTP link to force the browser to jump inside to HTTPS and to hijack it by bypassing the middleman.
  • X-Frame-Options You can block the display of your page when it is embedded in a fishing website, thereby thwarting the click hijacking.

Addressing the challenge of “security and functional balance” configuration

The most difficult place to deploy is to avoid “mistake” of legal functions. For example, one that's too strict. Content-Security-Policy Could result in your payment plugin or statistical script being invalidated. Our reference guide provides each head with:

  • Best practice value: Industry-recognized safety configuration programmes.
  • Configure Example: Snippets for Nginx and Apache.
  • Compatibility hint: Which old versions of browsers may not be supported.

Importance of periodic audits

Web security standards are evolving. It was considered safe. X-XSS-Protection It's now considered obsolete and replaced by stronger. CSP 。 Again, new. Permissions-Policy I'm replacing the old one. Feature-Policy 。 Regular use of this guide to take stock of your server configuration is key to ensuring long-term security of application.

The tool is intended to serve as a desk manual for developers, security engineers and transport personnel. You can strengthen the server by quickly locating the head as required by search and classification functions and by reference to best practice values.