Link to this headingHeaders
Link to this headingContent-Security-Policy
- Limits XSS by restricting loads
Source
CSP Bypass’s
CSP Evaluator
Example:
Report Only Example:
Link to this headingStrict-Transport-Security
- This site should only be accessed by HTTPS
- includeSubDomains also enforces this on all subdomains
- preload adds the domain to the browsers list of HTTPS only domains forever
Example:
Link to this headingX-Content-Type-Options
This header ensures that the MIME types set by the application are respected by browsers. This can help prevent certain types of cross site scripting bypasses.
It also reduces unexpected application behavior where a browser may “guess” some kind of content incorrectly, such as when a developer labels a page “HTML” but the browser thinks it looks like JavaScript and tries to render it as JavaScript. This header will ensure the browser always respects the MIME type set by the server.
Example:
Link to this headingCache Control Headers
Any page with sensitive data, such as a user page or a customer checkout page, should be set to no-cache. One reason for this is preventing someone on a shared computer from pressing the back button or going through history and being able to view personal information.
However, pages that change rarely, such as static assets (images, CSS files, and JS files), are good to cache. This could be done on a page by page basis, or using regex on the server configuration.
Link to this headingX-Frame-Options
This header indicates whether the site should be allowed to be displayed within an iFrame.
If a malicious site puts your website within an iFrame, the malicious site is able to perform a click jacking attack by running some JavaScript that will capture mouse clicks on the iFrame and then interact with the site on the users behalf (not necessarily clicking where they think they clicked!).
Example:
Link to this headingAccess-Control
Link to this headingAccess-Control-Allow-Credentials
- Allows the browser to set cookies, authorization headers or TLS client certificates to send to the server in a Cross Origin Request
- This information is gathered in the preflight request
Example:
Link to this headingAccess-Control-Allow-Headers
- Specifies which headers can be send in a Cross Origin Request
- This information is gathered in the preflight request
Usage:
Link to this headingAccess-Control-Request-Headers
- Specifies which headers the client might send the server in a Cross Origin Request
- This information is gathered in the preflight request
Usage:
Link to this headingAccess-Control-Allow-Methods
- Specifies what HTTP Verbs can be set in a Cross Origin Request
- This information is gathered in the preflight request
Examples:
Link to this headingAccess-Control-Request-Method
- Specifies what HTTP Verbs is sent with the Cross Origin Request
- This information is gathered in the preflight request
Examples:
Link to this headingAccess-Control-Allow-Origin
- Specifies what origins can make Cross Origin Requests
- This information is gathered in the preflight request
Example:
NOTE: “null” may allow cross origin to “data:” and “file:” scheme
Link to this headingAccess-Control-Expose-Headers
- Specifies what HTTP Response Headers can be viewed by javascript in a Cross Origin Request
- This information is gathered in the preflight request
By default the headers below are accessible from a Cross Origin Response
- Cache-Control
- Content-Language
- Content-Type
- Expires
- Last-Modified
- Pragma
Example:
NOTE: Wildcard headers wont expose the Authorization header
Link to this headingAccess-Control-Max-Age
- Specifies how long the HTTP Response can be cached for from a javascript in a Cross Origin Request
- This information is gathered in the preflight request
Example:
Link to this headingPublic-Key-Pins
- Deprecated
- Used to pin certificates to a website
Usage:
Example:
Link to this headingExpect CT
- Enforce flag makes it restrict HTTP instead of just reporintg
Usage:
Example:
Link to this headingCross-Origin-Resource-Policy
- Response Header that specifies the origin policy of the website
Usage:
Example:
Link to this headingCross-Origin-Opener-Policy
- Used to whitelist the postMessage messages that can be received by restricting the origins
Link to this headingCross-Origin-Embedder-Policy
- Used to whitelist the postMessage messages that can be sent by restricting the origins
Link to this headingWant-Digest
- The Client specifies to the server that it wants to send a Digest header with the response
Usage:
Examples:
Link to this headingDigest
- Hash of the method body
Usage:
Examples:
Link to this headingForwarded
- Shows the Forward Proxy Information
Usage:
Examples:
Link to this headingProxy-Authenticate
- The Server Specifies the Authentication that is required to gain access to a webpage beyond the proxy server.
Usage:
Examples:
Link to this headingProxy-Authorization
- The Server Specifies the Authentication that is required to gain access to a webpage beyond the proxy server.
Usage:
Examples:
Link to this headingSec-WebSocket-Accept
TODO
Usage:
Examples:
Link to this headingTiming-Allow-Origin
- Specifies what Origins are able to view the Resource Timing API information from a Cross Origin Request
Usage:
Examples:
Link to this headingWWW-Authenticate
- Specifies the Authorization method that is needed to gain access to a resource
Usage:
Examples:
Link to this headingX-DNS-Prefetch-Control
- Response Header that is used to prefetch the DNS Query of the site.
Usage:
Link to this headingX-Forwarded-For
- Request Header that specified the Client and the Proxies that are between the client and the server
Usage:
Examples:
Link to this headingX-Forwarded-Proto
- Response Header that is used to prefetch the DNS Query of the site.
Usage:
Examples:
Link to this headingX-Forwarded-Host
- Specifying the domain name of the forwarded server.
Usage:
Examples:
Link to this headingX-XSS-Protection
- Response Header that either sanitizes or blocks the page load if XSS detection is specified
Usage: