Headers for Hackers
summary
HTTP Archive loads the Alexa top 1M sites into BigQuery and shows concrete results: Expires appears on about 80% of responses, an X-Cache style header shows up on ~15%, and a single generated Content-Security-Policy can balloon to ~10KB. The notes describe Fastly experiments with 103 Early Hints to send Link preload before a final status, mention Feature-Policy shipping in Chrome, and propose an Origin-Policy JSON file to publish origin-wide settings instead of repeating headers.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:43Platform for Privacy Preferences Project?
- 9:37Outputting debug headers conditionally
- 11:20Proxy behaviour
- 11:41Proxy forwarding loops
- 12:57CSP Firewall in the browser
- 16:36Referrer policy options
related talks
46mHeaders for Hackers
45mHeaders for hackers
40mHTTP Headers for the Responsible Developer
30mHTTP headers for the responsible developer
39mHTTP headers for the responsible developer
26mNo Better ROI: HTTP Headers for Security
23mHTTP headers for the responsible developer
31mHTTP Security Headers: A Technology History Through Scar Tissue