HTTP Security Headers: A Technology History Through Scar Tissue
summary
History of browser-driven fixes that prevent real attacks and breakage: concrete headers and how to set them. Use X-Content-Type-Options: nosniff to stop MIME guessing, disable or set X-XSS-Protection: 0|mode=block instead of default filters, and enforce framing with X-Frame-Options DENY or SAMEORIGIN. Deploy HSTS preload with includeSubDomains (max-age ≥ a year) to avoid SSL-strip. Adopt Referrer-Policy (strict-origin or no-referrer), experiment with Feature/Permissions-Policy, and implement Content-Security-Policy with report-only, nonces or SHA256 hashes to remove unsafe-inline and iteratively tighten without breaking production.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:37Housekeeping
- 1:30Content
- 4:02Cross Site Scripting Protection
- 6:20X Frames
- 7:57Strict Transport Security
- 10:00How Does Strict Transport Security Help with this Situation
- 12:07Strict Transport Security Pre Loading
- 17:19Content Security Policy
- 19:38The Unsafe Inline for the Script Source Parameter
- 22:49Recap
- 27:58Content Security Policy Report Only Header
related talks
59mHTTP Security Headers You Need To Have On Your Web Apps
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
26mHTTP Headers - The Simplest Security
48mAdd more protection with HTTP Security Headers
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
21mSecurity with HTTP headers: overview of attacks and defenses
38mWhy Do We Need Security Headers?
45mHeaders for hackers