HTTP Headers - The Simplest Security
summary
Adds four concrete defenses: Content-Security-Policy blocks external scripts and disallows inline/eval unless explicitly whitelisted and offers a report-only mode; Strict-Transport-Security forces browsers to upgrade repeat visits to HTTPS with a tunable max-age but must be set over HTTPS; X-Frame-Options prevents clickjacking; X-XSS-Protection is legacy and historically buggy (IE regex bypasses). Live demo shows CSP stopping an injected script, and the recommended tool is helmet middleware for Express to set these headers consistently across browsers.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:40Cowsay
- 3:32Content Security Policy
- 5:11CSP: Resource Directives
- 7:57CSP: Keywords
- 11:30CSP: Gotchas
- 12:33Content Security PC
- 12:53CSP: Browser Support
- 13:35X-XSS-Protection - by MS
- 15:51X-XSS-Protection - Today
- 16:49Man in the Middle
- 17:45With HTTP Strict Transport Security
- 18:54HSTS: Gotchas
- 20:14HSTS: Verification
- 21:59Clickjacking
- 22:34X-Frame-Options vs. CSP
- 22:49X-Frame-Options: Browser Support
- 22:59Node Modules
- 23:46Summary
- 24:20Conclusions
related talks
31mHTTP Security Headers: A Technology History Through Scar Tissue
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
59mHTTP Security Headers You Need To Have On Your Web Apps
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
21mSecurity with HTTP headers: overview of attacks and defenses
48mAdd more protection with HTTP Security Headers
38mWhy Do We Need Security Headers?
30mHTTP headers for the responsible developer