Security Headers

Part of the Web course

A security review lands on your desk with fourteen items on it, and six of them turn out to be response headers you are not sending. That is the good news about this particular category of hardening: it is not a redesign, it is a handful of lines in your reverse proxy or framework config, and each one shuts down a whole class of attack that would otherwise need code changes to defend against.

A header is a line of metadata the server attaches to a response, alongside the actual content. The browser reads them before it does anything with the body. ...