Unit 3: Headers · Lesson 2 of 5 · 18 min
Security headers
A short list of headers that make the browser stricter, and how to review them.
mission
- You are
- The analyst reviewing the shop.
- Situation
- The shop's developers ask which security headers they are missing and what values to set.
- Goal
- Check the shop's pages against a known-good list.
- Hand in
- A gap list with the exact value to set for each header.
What each header defends
- Content-Security-PolicyWhich scripts and frames may run
- Strict-Transport-SecurityNever use plain HTTP for this site again
- X-Frame-Options or frame-ancestorsWho may put the page in a frame
- X-Content-Type-OptionsDo not guess file types
- Referrer-PolicyHow much of the URL leaks to other sites
The baseline
| Command | What it does |
|---|---|
Strict-Transport-Security | HTTPS only for this site. Aim for max-age=31536000 |
Content-Security-Policy | Where scripts, styles and frames may come from |
X-Content-Type-Options | nosniff: trust Content-Type, do not guess |
X-Frame-Options | DENY or SAMEORIGIN. CSP frame-ancestors is the modern form |
Referrer-Policy | strict-origin-when-cross-origin is a good default |
Server | Less version detail gives scanners less to match |
Read the shop page's security headers
curl -sI http://127.0.0.1:8000/shop | grep -iE '^(content-security|x-frame|referrer|x-content)'
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; object-src 'none'; frame-ancestors 'none'
you should see Four security headers. The Referrer-Policy is weaker than the baseline.
Read the home page
curl -sI http://127.0.0.1:8000/ | grep -ciE '^(content-security|x-frame|referrer)'
0
you should see 0. The home page has no policy, no framing rule and no referrer rule.
Look for HSTS
HSTS only counts on HTTPS responses. Over plain HTTP a browser ignores it.
curl -sI --cacert certs/shop-ca.crt https://shop.internal:8443/ | grep -i strict
Strict-Transport-Security: max-age=300
you should see max-age=300: five minutes instead of a year.
Check the help page too
curl -sI http://127.0.0.1:8000/help | grep -iE '^(content-security|x-frame|referrer|x-content)'
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'; connect-src 'self' https://api.example-ai.com
you should see A CSP and nosniff, but no framing or referrer header. Headers are set per page, so check every page that matters.
Referrer-Policy
Referrer-Policy: no-referrer-when-downgrade
Full URLs, query strings included, go to every HTTPS site you link to.
Referrer-Policy: strict-origin-when-cross-origin
Other sites only learn the origin, never the path or query.
What a defender takes away
- 1Check security headers per route, starting with sign-in and personal pages.
- 2HSTS needs a long max-age to protect anything.
- 3Recommend exact values, not just header names.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.