Headers for hackers

on YouTube ↗45m

" summary

Analysis of ~50 million requests from HTTP Archive shows real specifics not fluff: P3P appears on ~10% of responses as a bogus string, X-Cache shows up on ~13%, and only ~3% set a Content-Security-Policy. Practical fixes use CDNs and tools like securityheaders.io, server-side server-timing and trailers (now in Firefox), and client-side Client-Hints; proposals like Early-Hints and Feature-Policy are demonstrated, with experiments showing what breaks and what measurably speeds or secures pages.

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 6:58Platform for Privacy Preferences Project?
3. 16:26Proxy behaviour
4. 17:03Proxy forwarding loops
5. 18:49CSP. Firewall in the browser
6. 24:17Referrer policy options
7. 32:01The status code problem
8. 33:50Preloaded resources start preloading earlier
9. 35:25Server-timing metrics appear in developer tools
10. 36:17JavaScript API
11. 41:25What policies are available?

" related talks

• 46mHeaders for HackersAndrew Betts · performance.now() 2018
• 30mHeaders for HackersAndrew Betts · Nordic.js 2018
• 38mWhy Do We Need Security Headers?Jacek Marmuszewski · DevDays || DevOps Pro || CyberWiseCon Europe 2025
• 31mHTTP Security Headers: A Technology History Through Scar TissueBenjamin Hering · BSidesSF 2019
• 30mHTTP headers for the responsible developerStefan Judis · RuhrJS 2019
• 40mHTTP Headers for the Responsible DeveloperStefan Judis · Web Unleashed 2019
• 39mHTTP headers for the responsible developerStefan Judis · JavaScript fwdays'19
• 48mAdd more protection with HTTP Security HeadersCecilia Wirén · Update Conference Prague 2019