Seatbelts for Web App (Security Headers)
summary
Claims that a few browser headers can stop many attacks, with demos and real-world scans (Report URI shows low adoption). Concrete fixes: HSTS with preload to force HTTPS, Content-Security-Policy used in report‑only then enforce to block XSS and list allowed resources, and Permissions-Policy to apply least privilege to camera/mic. Tools and resources: securityheaders.com checks headers, Report‑URI and Semgrep’s cheat sheet help iterate safely. Notes include CORP/COEP for isolation and that HPKP and X‑XSS‑Protection are deprecated.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:35About the speakers
- 2:00Why security headers
- 3:34Browser security evolution
- 5:08Defining security headers
- 6:27The seat belt analogy
- 7:44Implementation challenges
- 9:57HSTS explained
- 15:23Content Security Policy
- 20:07Deploying CSP at scale
- 26:15Permissions policy
- 28:43Other essential headers
- 30:26Advanced origin isolation
- 36:13Forbidden headers
- 39:27Learning resources
- 41:54Call to action
- 45:06Q&A
related talks
59mHTTP Security Headers You Need To Have On Your Web Apps
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
31mHTTP Security Headers: A Technology History Through Scar Tissue
38mWhy Do We Need Security Headers?
26mHTTP Headers - The Simplest Security
55mWeb Application Security: Browsers Fight Back!
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
21mSecurity with HTTP headers: overview of attacks and defenses