Headers for Hackers
summary
Shows which headers actually matter and which are cruft: HTTP Archive finds CSP on 2.9% of sites, Strict-Transport-Security widely used, and worthless headers like P3P or many X- prefixes still appear on 10–13% of responses. Demonstrates tools and rollouts—clear-site-data ships in Chrome, Server-Timing exposes backend breakdowns, Client Hints change request/response flow, and a proposed 103 Early Hints enables Link rel=preload before final status to save critical milliseconds.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:29HTTP Headers
- 2:20Clear Site Data
- 3:53HTTP Archive
- 6:58Expired
- 10:57XCache
- 13:33Frame Ancestors
- 14:13Via
- 15:32CSP
- 17:38Strict Transport Security
- 19:08Referral Policy
- 20:20CrossOrigin
- 24:20Request headers
- 25:16Client hints
- 26:30Link
- 27:40Linkrel Preload
- 28:16The Problem
- 29:42Early Hints
- 31:07Server Timing
- 32:14Waiting
- 33:17JavaScript
- 34:11Feature Policy
- 37:36HTTP Header Compression
- 38:35Recap
- 39:01Header adoption
related talks
45mHeaders for hackers
30mHeaders for Hackers
39mHTTP headers for the responsible developer
40mHTTP Headers for the Responsible Developer
38mWhy Do We Need Security Headers?
30mHTTP headers for the responsible developer
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
31mHTTP Security Headers: A Technology History Through Scar Tissue