List of useful HTTP headers
This page lists useful security-related HTTP headers. In most architectures these headers can be set in web server configuration (Apache, IIS), without changing actual application's code. This offers significantly faster and cheaper method for at least partial mitigation of existing issues, and an additional layer of defense for new applications.
|Strict-Transport-Security||Enforces secure (HTTP over SSL/TLS) connections to the server. This reduces impact of bugs in web applications leaking session data through cookies and external links.|
|X-Frame-Options, Frame-Options||Clickjacking protection. Values: deny - no rendering within a frame, sameorigin - no rendering if origin mismatch, allow-from: URL - allow rendering frame if loaded from URL|| |
|X-XSS-Protection||This header enables Cross-site scripting (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so role of this headers is to re-enable for this particular website if it was disabled by the user.|| |
|X-Content-Type-Options||The only defined value, "nosniff", prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions. This reduces exposure to drive-by download attacks and sites serving user uploaded content that, by clever naming, could be treated by MSIE as executable or dynamic HTML files.|| |
Real life examples
Below examples present selected HTTP headers as set by popular websites to demonstrate that they are indeed being used in production services:
As of January 2013 Facebook main page was setting these security related HTTP headers.
Strict-Transport-Security: max-age=60 X-Content-Type-Options: nosniff X-Frame-Options: DENY X-WebKit-CSP: default-src *; script-src https://*.facebook.com http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' https://*.akamaihd.net http://*.akamaihd.net; style-src * 'unsafe-inline'; connect-src https://*.facebook.com http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.spotilocal.com:* https://*.akamaihd.net ws://*.facebook.com:* http://*.akamaihd.net; X-XSS-Protection: 1; mode=block
As of January 2013 Google+ main page was setting these security related HTTP headers:
x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block
As of May 2013 Twitter main page was setting these security related HTTP headers:
strict-transport-security: max-age=631138519 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block