HTTP security headers: An easy way to harden your web applications

HTTP Strict-Transport-Security (HSTS)

Purpose: force HTTPS. Block HTTP and invalid TLS bypass attempts.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Referrer-Policy

Purpose: control how much referrer info you send.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Purpose: control access to features like geolocation, camera, and microphone.

Permissions-Policy: geolocation=(), camera=(), microphone=()

X-Content-Type-Options

Purpose: stop MIME sniffing. This prevents the browser from guessing the content type, which can be dangerous (e.g., it might execute a text file uploaded by a user if it looks like a script).

X-Content-Type-Options: nosniff

COOP, COEP, CORP

Purpose: isolate your app from other origins and block cross-site leaks. Required for some advanced features like SharedArrayBuffer.

Clear-Site-Data: "cache", "cookies", "storage"  # Use on logout endpoints
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin

Cross-Origin Resource Sharing (CORS)

Purpose: allow specific cross-origin requests.

# Preflight (OPTIONS)
Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 600
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

# Simple/actual response
Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Credentials: true
Vary: Origin

Access-Control-Expose-Headers: Content-Length, X-Request-ID
Cross-Origin-Resource-Policy: same-origin

Fetch Metadata

Purpose: identify the request context and block cross-site abuse. Use it to harden CSRF defenses.

# Pseudocode: reject unsafe, non-navigational cross-site requests
site = get_header("Sec-Fetch-Site")
mode = get_header("Sec-Fetch-Mode")
is_unsafe_method = (method in [POST, PUT, PATCH, DELETE])
is_cross_site = (site == "cross-site")
is_navigational = (mode == "navigate")

# Block requests that are cross-site, unsafe, AND not a top-level navigation
if (is_cross_site && is_unsafe_method && !is_navigational) {
  reject()
}

function fetchMetadataGuard(req, res, next) {
  const site = req.get("Sec-Fetch-Site") || "";
  const mode = req.get("Sec-Fetch-Mode") || "";
  const dest = req.get("Sec-Fetch-Dest") || "";
  const unsafe = ["POST", "PUT", "PATCH", "DELETE"].includes(req.method);
  const allowedSameSite = site === "" || site === "same-origin" || site === "same-site";
  const isNavigation = mode === "navigate" && dest === "document";

  if (unsafe && !allowedSameSite && !isNavigation) return res.sendStatus(403);
  next();
}

Subresource Integrity (SRI)

Purpose: ensure CDN resources are not tampered with.

<script src="https://cdn.example.com/app.js" integrity="sha384-BASE64HASH" crossorigin="anonymous"></script>

Secure cookies

Purpose: protect sessions.

Set-Cookie: session=abc...; Path=/; Secure; HttpOnly; SameSite=Lax

Nginx

# /etc/nginx/conf.d/security.conf
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;

location / {
  set_by_lua_block $csp_nonce {
    local rand = require("resty.random").bytes(16, true)
    return ngx.encode_base64(rand)
  }

  add_header Content-Security-Policy
    "default-src 'self'; base-uri 'self'; object-src 'none'; \
    script-src 'self' 'nonce-$csp_nonce'; style-src 'self'; img-src 'self' data:; \
    frame-ancestors 'self'; upgrade-insecure-requests" always;
}

# CORS example for API
location /api/ {
    if ($request_method = 'OPTIONS') {
        add_header Access-Control-Allow-Origin "https://example.com";
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "Content-Type";
        add_header Access-Control-Allow-Credentials "true";
        add_header Access-Control-Max-Age 600;
        return 204;
    }
    add_header Access-Control-Allow-Origin "https://example.com";
    add_header Access-Control-Allow-Credentials "true";
    add_header Vary "Origin";
    proxy_pass http://backend;
}

Apache httpd

# In <VirtualHost> or .htaccess with AllowOverride All
# e.g., SetEnvIfNoCase Request_URI ".*" CSP_NONCE=%{UNIQUE_ID}e
Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; script-src 'self' 'nonce-%{CSP_NONCE}e'; style-src 'self'; img-src 'self' data:; frame-ancestors 'self'; upgrade-insecure-requests"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
Header always set X-Content-Type-Options "nosniff"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Embedder-Policy "require-corp"
Header always set Cross-Origin-Resource-Policy "same-origin"

# CORS example
<Location /api/>
  Header always set Access-Control-Allow-Origin "https://example.com"
  Header always set Access-Control-Allow-Credentials "true"
  Header always set Vary "Origin"
  RewriteEngine On
  RewriteCond %{REQUEST_METHOD} OPTIONS
  RewriteRule ^ - [R=204,L]
  Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
  Header always set Access-Control-Allow-Headers "Content-Type"
  Header always set Access-Control-Max-Age "600"
</Location>

Node.js Express

import express from "express";
import crypto from "crypto";

const app = express();

// CSP nonce per response
app.use((req, res, next) => {
  res.locals.cspNonce = crypto.randomBytes(16).toString("base64");
  next();
});

app.use((req, res, next) => {
  const nonce = res.locals.cspNonce;
  res.setHeader("Content-Security-Policy",
    "default-src 'self'; base-uri 'self'; object-src 'none'; " +
    "script-src 'self' 'nonce-" + nonce + "'; style-src 'self'; img-src 'self' data:; " +
    "frame-ancestors 'self'; upgrade-insecure-requests");
  res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
  res.setHeader("Permissions-Policy", "geolocation=(), camera=(), microphone=()");
  res.setHeader("X-Content-Type-Options", "nosniff");
  res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
  res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
  res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
  next();
});

// Fetch Metadata guard
app.use((req, res, next) => {
  const site = req.get("Sec-Fetch-Site");
  const unsafe = ["POST","PUT","PATCH","DELETE"].includes(req.method);
  if (site === "cross-site" && unsafe) return res.status(403).end();
  next();
});

// CORS allowlist example
app.use("/api", (req, res, next) => {
  const origin = req.get("Origin");
  if (origin === "https://example.com") {
    res.setHeader("Access-Control-Allow-Origin", origin);
    res.setHeader("Access-Control-Allow-Credentials", "true");
    res.setHeader("Vary", "Origin");
  }
  if (req.method === "OPTIONS") {
    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
    res.setHeader("Access-Control-Max-Age", "600");
    return res.status(204).end();
  }
  next();
});

app.get("/", (req, res) => {
  res.send(`<script nonce="${res.locals.cspNonce}">console.log("ok")</script>`);
});

app.listen(3000);

Cloudflare Workers

export default {
  async fetch(req, env, ctx) {
    const headers = new Headers({
      "Content-Security-Policy":
        "default-src 'self'; base-uri 'self'; object-src 'none'; " +
        "script-src 'self'; style-src 'self'; img-src 'self' data:; " +
        "frame-ancestors 'self'; upgrade-insecure-requests",
      "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
      "Referrer-Policy": "strict-origin-when-cross-origin",
      "Permissions-Policy": "geolocation=(), camera=(), microphone=()",
      "X-Content-Type-Options": "nosniff",
      "Cross-Origin-Opener-Policy": "same-origin",
      "Cross-Origin-Embedder-Policy": "require-corp",
      "Cross-Origin-Resource-Policy": "same-origin"
    });

    if (req.method === "OPTIONS") {
      headers.set("Access-Control-Allow-Origin", "https://example.com");
      headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
      headers.set("Access-Control-Allow-Headers", "Content-Type");
      headers.set("Access-Control-Allow-Credentials", "true");
      headers.set("Access-Control-Max-Age", "600");
      return new Response(null, { status: 204, headers });
    }

    headers.set("Access-Control-Allow-Origin", "https://example.com");
    headers.set("Access-Control-Allow-Credentials", "true");
    headers.append("Vary", "Origin");

    return new Response("OK", { headers });
  }
};

Verification

# Show all response headers
curl -s -D - https://example.com/ -o /dev/null

# Check a single header
curl -s -D - https://example.com/ -o /dev/null | grep -i strict-transport-security

# Check CORS preflight
curl -s -D - -X OPTIONS https://api.example.com/endpoint \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: POST" -o /dev/null

#!/bin/bash
# Comprehensive security header check
URL="https://example.com"
echo "Testing security headers for $URL"

CRITICAL_HEADERS=(
  "Content-Security-Policy"
  "Strict-Transport-Security"
  "X-Content-Type-Options"
  "Referrer-Policy"
  "Permissions-Policy"
)

# Fail if any required header is missing
for h in "${CRITICAL_HEADERS[@]}"; do
  curl -s -D - https://example.com/ -o /dev/null | grep -iq "^$h:" || { echo "Missing $h"; exit 1; }
done

# Ensure CSP contains frame-ancestors
CSP_VALUE=$(curl -s -D - https://example.com/ -o /dev/null | awk 'BEGIN{IGNORECASE=1}/^Content-Security-Policy:/{print substr($0,index($0,$2))}')
echo "$CSP_VALUE" | grep -iq "frame-ancestors" || { echo "CSP missing frame-ancestors"; exit 1; }

# Test HSTS preload readiness
echo "HSTS Preload Check:"
curl -s "https://hstspreload.org/api/v2/status?domain=$(echo $URL | sed 's|https://||')" | jq .

Rollout and monitoring

• Inventory & Baseline (Week 1)
  • Map all domains/subdomains
  • Document current header state
  • Identify all third-party dependencies
• CSP Report-Only (Weeks 2-3)
  • Deploy CSP in report-only mode
  • Monitor violations for 14+ days
  • Fix legitimate violations in code
• Basic Headers (Week 4)
  • Deploy `X-Content-Type-Options: nosniff`
  • Deploy `Referrer-Policy: strict-origin-when-cross-origin`
  • Deploy `Permissions-Policy` with safe defaults
• HSTS Gradual (Weeks 5-8)
  • Start with `max-age=300` on non-critical subdomain
  • Gradually increase to `max-age=31536000`
  • Add `includeSubDomains` only after all subdomains verified
• CSP Enforcement (Week 9+)
  • Switch CSP to enforce mode
  • Keep reporting enabled
  • Monitor for new violations
• Advanced Isolation (Optional)
  • Deploy COOP/COEP/CORP only if needed
  • Test cross-origin isolation requirements

Common mistakes

• Using Access-Control-Allow-Origin: * with credentials. This is invalid and unsafe. Use an allowlist and Vary: Origin.
• Sending only X-Frame-Options. Use frame-ancestors in CSP.
• Forgetting X-Content-Type-Options: nosniff.
• Not setting cookie flags. Use Secure; HttpOnly; SameSite.
• Preloading HSTS before you are ready.
• Breaking third-party widgets with COEP or CORP. Audit and add explicit permissions.
• Treating CSP as a silver bullet. You still need output encoding and input validation.