HTTP bezpečnostné hlavičky: Jednoduchý spôsob, ako posilniť vaše webové aplikácie

HTTP Strict-Transport-Security (HSTS)

Účel: vynútiť HTTPS. Blokovať HTTP a pokusy o obchádzanie neplatným TLS.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Referrer-Policy

Účel: riadiť, koľko informácií o odkazujúcej stránke odosielate.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Účel: riadiť prístup k funkciám, ako sú geolokácia, kamera a mikrofón.

Permissions-Policy: geolocation=(), camera=(), microphone=()

X-Content-Type-Options

Účel: zastaviť MIME sniffing. Zabraňuje tomu, aby prehliadač hádal typ obsahu, čo môže byť nebezpečné (napr. ak súbor vyzerá ako skript, môže vykonať textový súbor nahraný používateľom).

X-Content-Type-Options: nosniff

COOP, COEP, CORP

Účel: izolovať vašu aplikáciu od iných pôvodov a blokovať úniky medzi stránkami. Vyžadované pre niektoré pokročilé funkcie, ako je SharedArrayBuffer.

Clear-Site-Data: "cache", "cookies", "storage"  # Use on logout endpoints
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin

Cross-Origin Resource Sharing (CORS)

Účel: povoliť špecifické požiadavky medzi odlišnými pôvodmi.

# Preflight (OPTIONS)
Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 600
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

# Simple/actual response
Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Credentials: true
Vary: Origin

Access-Control-Expose-Headers: Content-Length, X-Request-ID
Cross-Origin-Resource-Policy: same-origin

Fetch Metadata

Účel: identifikovať kontext požiadavky a blokovať zneužitie naprieč stránkami. Použite na posilnenie obrany proti CSRF.

# Pseudocode: reject unsafe, non-navigational cross-site requests
site = get_header("Sec-Fetch-Site")
mode = get_header("Sec-Fetch-Mode")
is_unsafe_method = (method in [POST, PUT, PATCH, DELETE])
is_cross_site = (site == "cross-site")
is_navigational = (mode == "navigate")

# Block requests that are cross-site, unsafe, AND not a top-level navigation
if (is_cross_site && is_unsafe_method && !is_navigational) {
  reject()
}

function fetchMetadataGuard(req, res, next) {
  const site = req.get("Sec-Fetch-Site") || "";
  const mode = req.get("Sec-Fetch-Mode") || "";
  const dest = req.get("Sec-Fetch-Dest") || "";
  const unsafe = ["POST", "PUT", "PATCH", "DELETE"].includes(req.method);
  const allowedSameSite = site === "" || site === "same-origin" || site === "same-site";
  const isNavigation = mode === "navigate" && dest === "document";

  if (unsafe && !allowedSameSite && !isNavigation) return res.sendStatus(403);
  next();
}

Subresource Integrity (SRI)

Účel: zabezpečiť, aby CDN zdroje neboli pozmenené.

<script src="https://cdn.example.com/app.js" integrity="sha384-BASE64HASH" crossorigin="anonymous"></script>

Bezpečné súbory cookie

Účel: chrániť relácie.

Set-Cookie: session=abc...; Path=/; Secure; HttpOnly; SameSite=Lax

Nginx

# /etc/nginx/conf.d/security.conf
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;

location / {
  set_by_lua_block $csp_nonce {
    local rand = require("resty.random").bytes(16, true)
    return ngx.encode_base64(rand)
  }

  add_header Content-Security-Policy
    "default-src 'self'; base-uri 'self'; object-src 'none'; \
    script-src 'self' 'nonce-$csp_nonce'; style-src 'self'; img-src 'self' data:; \
    frame-ancestors 'self'; upgrade-insecure-requests" always;
}

# CORS example for API
location /api/ {
    if ($request_method = 'OPTIONS') {
        add_header Access-Control-Allow-Origin "https://example.com";
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "Content-Type";
        add_header Access-Control-Allow-Credentials "true";
        add_header Access-Control-Max-Age 600;
        return 204;
    }
    add_header Access-Control-Allow-Origin "https://example.com";
    add_header Access-Control-Allow-Credentials "true";
    add_header Vary "Origin";
    proxy_pass http://backend;
}

Apache httpd

# In <VirtualHost> or .htaccess with AllowOverride All
# e.g., SetEnvIfNoCase Request_URI ".*" CSP_NONCE=%{UNIQUE_ID}e
Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; script-src 'self' 'nonce-%{CSP_NONCE}e'; style-src 'self'; img-src 'self' data:; frame-ancestors 'self'; upgrade-insecure-requests"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
Header always set X-Content-Type-Options "nosniff"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Embedder-Policy "require-corp"
Header always set Cross-Origin-Resource-Policy "same-origin"

# CORS example
<Location /api/>
  Header always set Access-Control-Allow-Origin "https://example.com"
  Header always set Access-Control-Allow-Credentials "true"
  Header always set Vary "Origin"
  RewriteEngine On
  RewriteCond %{REQUEST_METHOD} OPTIONS
  RewriteRule ^ - [R=204,L]
  Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
  Header always set Access-Control-Allow-Headers "Content-Type"
  Header always set Access-Control-Max-Age "600"
</Location>

Node.js Express

import express from "express";
import crypto from "crypto";

const app = express();

// CSP nonce per response
app.use((req, res, next) => {
  res.locals.cspNonce = crypto.randomBytes(16).toString("base64");
  next();
});

app.use((req, res, next) => {
  const nonce = res.locals.cspNonce;
  res.setHeader("Content-Security-Policy",
    "default-src 'self'; base-uri 'self'; object-src 'none'; " +
    "script-src 'self' 'nonce-" + nonce + "'; style-src 'self'; img-src 'self' data:; " +
    "frame-ancestors 'self'; upgrade-insecure-requests");
  res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
  res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
  res.setHeader("Permissions-Policy", "geolocation=(), camera=(), microphone=()");
  res.setHeader("X-Content-Type-Options", "nosniff");
  res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
  res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
  res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
  next();
});

// Fetch Metadata guard
app.use((req, res, next) => {
  const site = req.get("Sec-Fetch-Site");
  const unsafe = ["POST","PUT","PATCH","DELETE"].includes(req.method);
  if (site === "cross-site" && unsafe) return res.status(403).end();
  next();
});

// CORS allowlist example
app.use("/api", (req, res, next) => {
  const origin = req.get("Origin");
  if (origin === "https://example.com") {
    res.setHeader("Access-Control-Allow-Origin", origin);
    res.setHeader("Access-Control-Allow-Credentials", "true");
    res.setHeader("Vary", "Origin");
  }
  if (req.method === "OPTIONS") {
    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
    res.setHeader("Access-Control-Max-Age", "600");
    return res.status(204).end();
  }
  next();
});

app.get("/", (req, res) => {
  res.send(`<script nonce="${res.locals.cspNonce}">console.log("ok")</script>`);
});

app.listen(3000);

Cloudflare Workers

export default {
  async fetch(req, env, ctx) {
    const headers = new Headers({
      "Content-Security-Policy":
        "default-src 'self'; base-uri 'self'; object-src 'none'; " +
        "script-src 'self'; style-src 'self'; img-src 'self' data:; " +
        "frame-ancestors 'self'; upgrade-insecure-requests",
      "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
      "Referrer-Policy": "strict-origin-when-cross-origin",
      "Permissions-Policy": "geolocation=(), camera=(), microphone=()",
      "X-Content-Type-Options": "nosniff",
      "Cross-Origin-Opener-Policy": "same-origin",
      "Cross-Origin-Embedder-Policy": "require-corp",
      "Cross-Origin-Resource-Policy": "same-origin"
    });

    if (req.method === "OPTIONS") {
      headers.set("Access-Control-Allow-Origin", "https://example.com");
      headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
      headers.set("Access-Control-Allow-Headers", "Content-Type");
      headers.set("Access-Control-Allow-Credentials", "true");
      headers.set("Access-Control-Max-Age", "600");
      return new Response(null, { status: 204, headers });
    }

    headers.set("Access-Control-Allow-Origin", "https://example.com");
    headers.set("Access-Control-Allow-Credentials", "true");
    headers.append("Vary", "Origin");

    return new Response("OK", { headers });
  }
};

Overenie

# Show all response headers
curl -s -D - https://example.com/ -o /dev/null

# Check a single header
curl -s -D - https://example.com/ -o /dev/null | grep -i strict-transport-security

# Check CORS preflight
curl -s -D - -X OPTIONS https://api.example.com/endpoint \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: POST" -o /dev/null

#!/bin/bash
# Comprehensive security header check
URL="https://example.com"
echo "Testing security headers for $URL"

CRITICAL_HEADERS=(
  "Content-Security-Policy"
  "Strict-Transport-Security"
  "X-Content-Type-Options"
  "Referrer-Policy"
  "Permissions-Policy"
)

# Fail if any required header is missing
for h in "${CRITICAL_HEADERS[@]}"; do
  curl -s -D - https://example.com/ -o /dev/null | grep -iq "^$h:" || { echo "Missing $h"; exit 1; }
done

# Ensure CSP contains frame-ancestors
CSP_VALUE=$(curl -s -D - https://example.com/ -o /dev/null | awk 'BEGIN{IGNORECASE=1}/^Content-Security-Policy:/{print substr($0,index($0,$2))}')
echo "$CSP_VALUE" | grep -iq "frame-ancestors" || { echo "CSP missing frame-ancestors"; exit 1; }

# Test HSTS preload readiness
echo "HSTS Preload Check:"
curl -s "https://hstspreload.org/api/v2/status?domain=$(echo $URL | sed 's|https://||')" | jq .

Nasadzovanie a monitorovanie

• Inventarizácia a východiskový stav (týždeň 1)
  • Zmapujte všetky domény a subdomény
  • Zadokumentujte aktuálny stav hlavičiek
  • Identifikujte všetky závislosti tretích strán
• CSP Report-Only (týždne 2–3)
  • Nasaďte CSP v režime report-only
  • Monitorujte porušenia 14 a viac dní
  • Opravte legitímne porušenia v kóde
• Základné hlavičky (týždeň 4)
  • Nasadiť `X-Content-Type-Options: nosniff`
  • Nasadiť `Referrer-Policy: strict-origin-when-cross-origin`
  • Nasadiť `Permissions-Policy` s bezpečnými predvolenými hodnotami
• HSTS postupne (týždne 5–8)
  • Začnite s `max-age=300` na nekritickej subdoméne
  • Postupne zvýšte na `max-age=31536000`
  • `includeSubDomains` pridajte až po overení všetkých subdomén
• CSP vynucovanie (týždeň 9+)
  • Prepnite CSP do režimu vynucovania
  • Ponechajte zapnuté reportovanie
  • Monitorujte nové porušenia
• Pokročilá izolácia (voliteľné)
  • Nasaďte COOP/COEP/CORP iba ak je to potrebné
  • Otestujte požiadavky na izoláciu medzi pôvodmi

Bežné chyby

• Použitie Access-Control-Allow-Origin: * s povereniami. Je to neplatné a nebezpečné. Použite zoznam povolených a Vary: Origin.
• Posielanie iba X-Frame-Options. Použite frame-ancestors v CSP.
• Zabudnutie na X-Content-Type-Options: nosniff.
• Nenastavené príznaky cookie. Použite Secure; HttpOnly; SameSite.
• Preload HSTS skôr, než ste pripravení.
• Rozbitie widgetov tretích strán pomocou COEP alebo CORP. Urobte audit a pridajte explicitné povolenia.
• Vnímanie CSP ako jedinej záchrany. Stále potrebujete kódovanie výstupov a validáciu vstupov.