TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

HTTP Security Headers

2 点作者 purec将近 4 年前

1 comment

zzo38computer将近 4 年前
I dislike HSTS and the remote reporting features. So, I would not want to implement them in a new web browser (if there is any report, it can be viewed by the end user (perhaps in the web developer console, with an indicator in the status line to indicate if any reports are available), who can then save it or do whatever else is wanted with it).<p>I also dislike &quot;X-Content-Type-Options: nosniff&quot;; the browser should never try to guess the MIME type, and should always use the Content-Type header unless it is overridden by the user. Of course, it is harmless for the web site operator to include such a header, since it will be ignored by clients that do not understand it. I merely say that the effect of &quot;X-Content-Type-Options: nosniff&quot; would be implied in any browser that I would want to write.<p>The other headers can be useful.<p>One of the features that I would want to include in a new web browser is user-defined header rewriting (both requests and responses) (which is the only way to set language preferences and Do-Not-Track, among other things); the headers described in the linked document (both old and new) can then be useful as a standardized way for the end user to configure several other options too. (Independently of this, there are many other things I would change too (e.g. changing the way deice handling works entirely), but that is beyond the scope of the current topic.)<p>Also, in my opinion, scripts should never be executed for &lt;img&gt;; if you need scripts, other commands such as &lt;object&gt; or &lt;iframe&gt; should be used instead. (Although, scripts should usually be avoided when not needed anyways.)<p>It is also necessary to ensure that &lt;meta http-equiv&gt; is implemented securely. It should never add permissions which have been denied, nor conflict with anything that has already been loaded (e.g. you can&#x27;t override the MIME type in a &lt;meta&gt;, since it is already HTML if the &lt;meta&gt; is to be parsed at all).
评论 #27206477 未加载