Enhancing Application Security: Understanding and Utilizing Browser Security Features
summary
Lists exact headers to add, where to add them, and what they actually stop: X-XSS-Protection: 1; mode=block blocks many reflected XSS cases, X-Content-Type-Options: nosniff prevents browser MIME sniffing and drive‑by downloads, HSTS (and HSTS preload) forces TLS so redirects can’t be stripped, HPKP is effectively deprecated, and CAA DNS records limit which CAs can issue certs. Demonstrations use Mozilla Observatory and Google’s CSP Evaluator, recommend CSP with report‑uri report‑only for phased rollout, and note headers can be injected at Lambda@Edge, load balancer, or web server.
AI-written summary · about
chapters (17)
- 0:00Start
- 3:14GOALS AND OBJECTIVES
- 5:08HTTP HEADERS IN 2018
- 11:02CROSS-ORIGIN RESOURCE SHARING (CORS)
- 11:51CROSS-ORIGIN RESOURCE SHARING COR
- 12:56CORS AND PREFLIGHT EXAMPLES
- 15:15CORS HEADERS
- 18:46POLLING QUESTION (ARE YOU STILL AWAKE?)
- 20:38X-XSS-PROTECTION
- 26:38HTTP STRICT TRANSPORT SECURITY (HSTS)
- 37:04CONTENT SECURITY POLICY CSF
- 37:28CONTENT SECURITY POLICY (CSP)
- 38:07CSP DIRECTIVES
- 38:33EXAMPLE CSP POLICY
- 41:16CSP PARSING ASSISTANCE DEMO
- 45:18TOOLS FOR HELPING TO ASSESS SECURITY HEADERS.
- 46:14WHERE ARE WE NOW?
related talks
31mHTTP Security Headers: A Technology History Through Scar Tissue
26mHTTP Headers - The Simplest Security
59mHTTP Security Headers You Need To Have On Your Web Apps
21mSecurity with HTTP headers: overview of attacks and defenses
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
52mSeatbelts for Web App (Security Headers)
38mWhy Do We Need Security Headers?