HTTP Security Headers You Need To Have On Your Web Apps
summary
Explains which headers matter (HSTS, CSP, X-Frame-Options, Referrer-Policy, X-Content-Type-Options, Feature/Permissions Policy), shows live before/after demos (HSTS does a HSTS 307 internal redirect vs a vulnerable 301, CSP breaks sites if misconfigured, Feature Policy can block camera access), recommends incremental rollout with CSP report-only and report-uri, cites tools and resources (securityheaders.com, hstspreload.org, helmet/nwebsec, lambda@edge), notes audits find many failures — securityheaders.com scan: 70M/127M failed.
AI-written summary · about
chapters (27)
- 0:00Intro
- 0:38Audience
- 4:07What are HTTP Headers?
- 4:56What are HTTP Security Headers?
- 6:30HTTP Strict Transport Security (HSTS)
- 7:01Without HSTS
- 7:33What's the issue?
- 7:53What can happen?
- 8:35With HSTS
- 9:21HSTS Options
- 10:47HSTS Preload List
- 13:53HSTS Gotchas
- 14:26HSTS Impact of Retrofitting on Existing A
- 15:18Quick word on HTTPS
- 21:51Cross-Site Scripting (XSS)
- 25:09XSS Final Note
- 27:30Content Security Policy (CSP) Options
- 35:59CSP Impacting of Retrofitting to Existing
- 39:15Browser Sniffing Protection X-Content-Type
- 40:39XCTO Impact of Retrofitting to Existing AS
- 41:52Referer Header background
- 43:51and even JIRA/Confluence/OWA
- 44:40Referrer-Policy
- 46:39Feature-Policy Is Experimental
- 52:18How do I test my website?
- 56:12Takeaways
- 57:29Resources
related talks
31mHTTP Security Headers: A Technology History Through Scar Tissue
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
52mSeatbelts for Web App (Security Headers)
26mHTTP Headers - The Simplest Security
21mSecurity with HTTP headers: overview of attacks and defenses
30mSecurity with HTTP Headers: Overview of Attacks and Defenses
48mAdd more protection with HTTP Security Headers
38mWhy Do We Need Security Headers?