GlossarySecurity Headers

Security headers are HTTP headers that enhance the security of web applications. They protect against various attacks by instructing the browser how specific security aspects of the application should be handled.

• Strict-Transport-Security: Enforces HTTPS and protects against man-in-the-middle attacks by instructing the browser to communicate only over HTTPS.
• Content-Security-Policy: Prevents cross-site scripting (XSS) and content injection attacks by defining the sources from which content may be loaded.
• Permissions-Policy: Controls which features and APIs can be used in the browser, e.g., location access or camera.
• X-Frame-Options: Prevents clickjacking by specifying whether a page may be displayed inside a frame.
• X-Content-Type-Options: Prevents MIME type sniffing that can cause vulnerabilities by instructing the browser to honor the declared content type.
• X-Permitted-Cross-Domain-Policies: Controls how plugins like Flash handle cross-domain policies to minimize security risks.
• Referrer-Policy: Controls the amount of referrer information sent with requests to protect privacy.
• Clear-Site-Data: Instructs the browser to clear specific browsing data such as cookies and cache under certain conditions.
• Cross-Origin-Embedder-Policy: Ensures robust security when embedding content by strictly handling cross-origin resources.
• Cross-Origin-Opener-Policy: Improves isolation by restricting interactions to same-origin documents, minimizing the risk of cross-origin attacks.
• Cross-Origin-Resource-Policy: Controls access to resources from other origins to prevent data leaks.