Add more protection with HTTP Security Headers
summary
Statistics show only about 14–16% of top sites use security headers and Content-Security-Policy sits at roughly 5% adoption. Concrete takeaways: add X-Content-Type-Options: nosniff; implement Strict-Transport-Security with a low initial max-age and includeSubDomains (use preload only after testing); deploy CSP incrementally via report-only and use nonces or hashes for inline scripts; add X-Frame-Options or frame-ancestors; set Referrer-Policy; use middleware or web.config/Startup.cs helpers and reporting endpoints to collect violation JSON.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:02HTTP "Security" Headers
- 7:18asp.net: Web.config
- 10:15Strict-Transport-Security
- 12:59asp.net core: Startup.cs
- 31:35X-Frame-Options
- 36:00Referrer-Policy
related talks
31mHTTP Security Headers: A Technology History Through Scar Tissue
26mHTTP Headers - The Simplest Security
59mHTTP Security Headers You Need To Have On Your Web Apps
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
43mRestricting the scripts, you're ...
45mHeaders for hackers
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
30mHTTP headers for the responsible developer