HTTP Headers for the Responsible Developer
summary
HTTP headers can force HTTPS with HSTS preload, block or report rogue scripts with Content-Security-Policy (only ~6% of 2.8M pages enable it), and save bandwidth via Save-Data header and client hints (Accept-CH +/- width) so images and HTML are served as WebP/Brotli. Practical tooling cited: HTTP Archive + BigQuery, Lighthouse, webhint. Real examples: demo pages using Brotli, client hints and preload; Shopify reports ~13% less data when honoring save‑data (20% of requests from India/Brazil).
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:45The web connects people
- 2:21and I want to be a responsible developer
- 4:03The challenge of building a "good" website
- 6:13How can we use headers to make this site better?
- 9:17Ensure encryption
- 12:00Limit what's allowed
- 15:07Always monitor your CSP reports and "test in production" with report-only before enforcing them! Troy Hunt
- 15:46The web is crucial for people.
- 17:43Don't request the same content over and over again
- 20:30Default Mode
- 21:01Brotli tends to compress better with the same speed
- 21:19You don't have to do it on the fly...
- 22:00Serve tailored media
- 24:04Serve a tailored version via server/service worker
- 26:22We should provide an easy way to save data!
- 27:50Less Data Doesn't Mean a Lesser Experience @tkadlec
- 31:11This is great to speed up critical resources
- 34:17What happened to the most annoying one?
- 37:36Building for the web is very hard
- 39:34The web has to be safe, affordable and respectful...
related talks
39mHTTP headers for the responsible developer
23mHTTP headers for the responsible developer
30mHTTP headers for the responsible developer
46mHeaders for Hackers
31mHTTP Security Headers: A Technology History Through Scar Tissue
59mHTTP Security Headers You Need To Have On Your Web Apps
45mHeaders for hackers
30mHeaders for Hackers