Security with HTTP headers: overview of attacks and defenses
summary
Overview of HTTP security headers (CSP, HSTS, X-Frame-Options, CORS and related headers) and how they help mitigate web attacks like XSS, CSRF, SSRF. Explains each vulnerability and which headers limit their impact, then reviews tools and resources to deploy these headers in applications.
AI-written summary · about
chapters (7)
- 0:00HTTP security overview
- 6:48Clickjacking defenses
- 9:37CSRF defenses
- 12:03CSRF tokens in forms
- 14:54CORS and Same-Origin limits
- 17:59XSS prevention with CSP
- 20:46Cookie best practices
related talks
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
31mHTTP Security Headers: A Technology History Through Scar Tissue
26mHTTP Headers - The Simplest Security
59mHTTP Security Headers You Need To Have On Your Web Apps
38mWhy Do We Need Security Headers?
24mTurn Your Browser into a Hacker Trap with HTTP Security Headers
52mSeatbelts for Web App (Security Headers)