TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

HTTP Security Headers – A Complete Guide

709 pointsby BCharliealmost 6 years ago

14 comments

deftnerdalmost 6 years ago
This is a good basic overview of the basic headers, but I suggest spending some time on Scott Helme&#x27;s blog. He runs securityheaders.io, a free service that scans your site, and assigns it a letter grade based on what headers and configurations you&#x27;ve applied.<p>For instance, his explanation of Content Security Policy headers is much more detailed than in the OP&#x27;s link.<p><a href="https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;content-security-policy-an-introduction&#x2F;" rel="nofollow">https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;content-security-policy-an-introduc...</a>
评论 #20469724 未加载
评论 #20483369 未加载
spectre256almost 6 years ago
It&#x27;s definitely worth repeating the warning that, while very useful, Strict-Transport-Security should be deployed with special care!<p>While the author&#x27;s example of `max-age=3600` means there&#x27;s only an hour of potential problems, enabling Strict-Transport-Security has the potential to prevent people from accessing your site if for whatever reason you are no longer able to serve HTTPS traffic.<p>Considering another common setting is to enable HSTS for a year, its worth enabling only deliberately and with some thought.
评论 #20470781 未加载
评论 #20469253 未加载
评论 #20469302 未加载
评论 #20469385 未加载
评论 #20469285 未加载
评论 #20471529 未加载
评论 #20471673 未加载
评论 #20469317 未加载
评论 #20469395 未加载
评论 #20476251 未加载
undecidabotalmost 6 years ago
Nice list. You might want to consider setting a &quot;Referrer-Policy&quot;[1] for sites with URLs that you&#x27;d prefer not to leak.<p>Also, for &quot;Set-Cookie&quot;, the relatively new &quot;SameSite&quot;[2] directive would be a good addition for most sites.<p>Oh, and for CSP, check Google&#x27;s evaluator out[3].<p>[1] <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;Headers&#x2F;Referrer-Policy" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;Headers&#x2F;Re...</a><p>[2] <a href="https:&#x2F;&#x2F;www.owasp.org&#x2F;index.php&#x2F;SameSite" rel="nofollow">https:&#x2F;&#x2F;www.owasp.org&#x2F;index.php&#x2F;SameSite</a><p>[3] <a href="https:&#x2F;&#x2F;csp-evaluator.withgoogle.com" rel="nofollow">https:&#x2F;&#x2F;csp-evaluator.withgoogle.com</a>
评论 #20476312 未加载
Avamanderalmost 6 years ago
Instead of X-Frame-Options one should use CSP&#x27;s frame-ancestors option, it has wider support among modern browsers. But CSP deserves more than one paragraph in general.<p>He also missed Expect-Staple and Expect-CT, in addition to that, most of security headers have the option to specify an URI where failures are sent, very important in production environments.
评论 #20469556 未加载
评论 #20469309 未加载
Grollicusalmost 6 years ago
Should mention for Access-Control-Allow-Origin that the default value is the safe default and setting this header weakens site security.
评论 #20469432 未加载
mitchtbaumalmost 6 years ago
* [Signing HTTP Messages](<a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;id&#x2F;draft-cavage-http-signatures-09.html" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;id&#x2F;draft-cavage-http-signatures-09.ht...</a>)<p>* [HTTP Signatures](<a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;id&#x2F;draft-cavage-http-signatures-01.html" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;id&#x2F;draft-cavage-http-signatures-01.ht...</a>)<p>* [draft-cavage-http-signatures-10 - Signing HTTP Messages](<a href="https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;draft-cavage-http-signatures-10" rel="nofollow">https:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;draft-cavage-http-signatures-10</a>)<p>* [<a href="https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc4686.txt](https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc4686.txt)" rel="nofollow">https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc4686.txt](https:&#x2F;&#x2F;www.rfc-...</a><p>* [<a href="https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc3335.txt](https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc3335.txt)" rel="nofollow">https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc3335.txt](https:&#x2F;&#x2F;www.rfc-...</a>
the_common_manalmost 6 years ago
X-frame-options is obsolete. Most browsers complain loudly on the console or ignore the header. Use csp instead
评论 #20476345 未加载
评论 #20470612 未加载
dalfalmost 6 years ago
There is the Feature-Policy header too : allow and deny the use of browser features in its own frame. I&#x27;ve seen this header on a bank website.<p>Example :<p><pre><code> Feature-Policy: accelerometer &#x27;none&#x27;; autoplay &#x27;none&#x27;; camera &#x27;none&#x27;; fullscreen &#x27;none&#x27; </code></pre> Documentation: <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;Feature_Policy" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;Feature_Po...</a>
joecotalmost 6 years ago
I&#x27;m a little confused by the examples for Access-Control-Allow-Origin:<p>&gt; Access-Control-Allow-Origin: <a href="http:&#x2F;&#x2F;www.one.site.com" rel="nofollow">http:&#x2F;&#x2F;www.one.site.com</a><p>&gt; Access-Control-Allow-Origin: <a href="http:&#x2F;&#x2F;www.two.site.com" rel="nofollow">http:&#x2F;&#x2F;www.two.site.com</a><p>And in the examples setting both. Because in my experience you cannot set multiple [1]. Lots of people instead set it to * which is both bad and restricts use of other request options (such as withCredentials). It looks like the current working solution is to use regexes to return the right domain [2], but I&#x27;m currently having trouble getting that to work, so if there&#x27;s some better solution that works for people I&#x27;d love to hear it.<p>1. <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;CORS&#x2F;Errors&#x2F;CORSMultipleAllowOriginNotAllowed" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;HTTP&#x2F;CORS&#x2F;Error...</a> 2. <a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;1653308&#x2F;access-control-allow-origin-multiple-origin-domains" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;1653308&#x2F;access-control-a...</a>
评论 #20470436 未加载
评论 #20470632 未加载
jakejarvisalmost 6 years ago
Great overview.<p>If anyone&#x27;s interested, I wrote a guide a while ago on adding these headers via Cloudflare Workers, which can be helpful if you&#x27;re hosting a static site on S3, GitHub Pages, etc. where you can&#x27;t add these headers directly:<p><a href="https:&#x2F;&#x2F;jarv.is&#x2F;notes&#x2F;security-headers-cloudflare-workers&#x2F;" rel="nofollow">https:&#x2F;&#x2F;jarv.is&#x2F;notes&#x2F;security-headers-cloudflare-workers&#x2F;</a>
hcheungalmost 6 years ago
The nginx header directives are all not in correct syntax with the extra &quot;:&quot;, and for those directives with multiple values, it should be wrapped within a &quot;&quot; (such as &quot;1; mode=block&quot;), here is the correct settings:<p><pre><code> ## General Security Headers add_header X-XSS-Protection &quot;1; mode=block&quot;; add_header X-Frame-Options deny; add_header X-Content-Type-Options nosniff; add_header Strict-Transport-Security &quot;max-age=3600; includeSubDomains&quot;;</code></pre>
cujanovicalmost 6 years ago
<a href="https:&#x2F;&#x2F;www.netsparker.com&#x2F;whitepaper-http-security-headers&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.netsparker.com&#x2F;whitepaper-http-security-headers&#x2F;</a>
评论 #20471963 未加载
wheresvic1almost 6 years ago
For Node.js servers running on express, check out helmet[1] which adds a lot of these headers for you :)<p>[1] <a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;helmet" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;helmet</a>
yyykalmost 6 years ago
The X-XSS-Protection header recommendation is a Zombie recommendation which is at best outdated and at worst harmful. Its origins are based on old IE bugs but it introduces worse issues.<p>IMHO, the best value for X-XSS-Protection is either 0 (disabling it completely like Facebook does) or not providing the value at all and just letting the client browser use its default. Why?<p>First, XSS &#x27;protection&#x27; is about to not be implemented by most browsers. Google has decide to deprecate Chrome&#x27;s XSS Auditor[0], and stop supporting XSS &#x27;protection&#x27;. Microsoft has already removed its XSS filter from Edge[1]. Mozilla has never bothered to support it in Firefox.<p>So most leading net companies already think it doesn&#x27;t work. Safari of course supports the much stronger CSP. So it&#x27;s only possibly useful on IE - if you don&#x27;t support IE, might as well save the bytes.<p>Second, XSS &#x27;protection&#x27; protects less than one might think. In all implementing browsers, it has always been implemented as part of the HTML parser, making it useless against DOM-based attacks (and strictly inferior to CSP)[2].<p>Worse, the XSS &#x27;protection&#x27; can be used to <i>create</i> security flaws. IE&#x27;s default is to detect XSS and try to filter it out, this has been known to be buggy to the point of creating XSS on safe pages[3], which is why the typical recommendation has been the block behaviour. But blocking has been itself exploited in the past[4], and has side-channel leaks that even Google considers too difficult to catch[0] to the point of preferring to remove XSS &#x27;protection&#x27; altogether. Blocking has an obvious social exploitation which can create attacks or make attacks more serious.[5]<p>In short, the best idea is to get rid of browsers&#x27; XSS &#x27;protection&#x27; ASAP in favour of CSP, preferably by having all browsers deprecate it. This is happening anyway, so might as well save the bytes. But if you do provide the header, I suggest disable XSS &#x27;protection&#x27; altogether.<p>[0] <a href="https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!msg&#x2F;blink-dev&#x2F;TuYw-EZhO9g&#x2F;blGViehIAwAJ" rel="nofollow">https:&#x2F;&#x2F;groups.google.com&#x2F;a&#x2F;chromium.org&#x2F;forum&#x2F;#!msg&#x2F;blink-d...</a><p>[1] <a href="https:&#x2F;&#x2F;developer.microsoft.com&#x2F;en-us&#x2F;microsoft-edge&#x2F;platform&#x2F;changelog&#x2F;desktop&#x2F;17723&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developer.microsoft.com&#x2F;en-us&#x2F;microsoft-edge&#x2F;platfor...</a><p>[2] e.g. <a href="https:&#x2F;&#x2F;github.com&#x2F;WebKit&#x2F;webkit&#x2F;blob&#x2F;d70365e65de64b8f6eaf1ff5bf1a901765e47923&#x2F;Source&#x2F;WebCore&#x2F;html&#x2F;parser&#x2F;XSSAuditor.cpp" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;WebKit&#x2F;webkit&#x2F;blob&#x2F;d70365e65de64b8f6eaf1f...</a><p>[3] CVE-2014-6328, CVE-2015-6164, CVE-2016-3212..<p>[4] <a href="https:&#x2F;&#x2F;portswigger.net&#x2F;blog&#x2F;abusing-chromes-xss-auditor-to-steal-tokens" rel="nofollow">https:&#x2F;&#x2F;portswigger.net&#x2F;blog&#x2F;abusing-chromes-xss-auditor-to-...</a><p>[5] Assume that an attacker has enough access to normally allow XSS. If he does not, the filter is useless. If he does, the attacker can by definition trigger the filter. So trigger the filter, make a webpage be blocked, and call the affected user as &quot;support&quot;. From there the exploitation is obvious, and can be much worse than mere XSS. Now, remember that all those XSS filters in all likelihood have false positives, that may not be blocked by other defences because they&#x27;re not attacks. So It&#x27;s quite possible the filter introduces a social attack that wouldn&#x27;t be possible otherwise!<p>Hattip: <a href="https:&#x2F;&#x2F;frederik-braun.com&#x2F;xssauditor-bad.html" rel="nofollow">https:&#x2F;&#x2F;frederik-braun.com&#x2F;xssauditor-bad.html</a> which gave me even more reasons to think browsers&#x27; XSS &#x27;protection&#x27; is awful. I didn&#x27;t know about [2] before reading his entry.
评论 #20475580 未加载
评论 #20474380 未加载