Security headers (HSTS, CSP and more)

In short: Security headers are HTTP response lines with which a server gives the browser protective rules.

In more detail: The browser enforces them and thereby blocks entire classes of attacks, even if the application itself has a bug. They are a second line of defence.

In Depth

• Strict-Transport-Security (HSTS): The browser uses only HTTPS for the domain, even if “http://” is typed.
• Content-Security-Policy (CSP): defines where scripts, images and frames may be loaded from. Protects strongly against XSS.
• X-Content-Type-Options: nosniff: The browser may not guess file types.
• X-Frame-Options / frame-ancestors: prevents embedding in other sites (clickjacking).
• Referrer-Policy: controls how much of the origin address is sent along.
• Permissions-Policy: switches camera, microphone, location off or on for the page.
• Cross-Origin-Opener-Policy: separates windows of different origin.
• Checking: Online scanners rate a page’s headers.

See also: CORS (cross-origin resource sharing), OWASP Top 10