Security headers

Security headers are directives a server attaches to a response to constrain what the browser will subsequently do with the page. They matter because a large share of web attacks execute inside the browser, where server-side code has no reach: the application cannot stop a script that has already been injected, but it can have told the browser in advance which script sources are permitted. The headers are a way of moving part of the security policy to the only component in a position to enforce it at the moment of the attack.

They are also the part of an assessment most likely to be misread in both directions. A scanning tool grades them in seconds and produces a letter, which makes them look like the headline finding when they are almost always a hardening measure rather than a vulnerability. Meanwhile a genuinely well-built content security policy is one of the few controls that reliably reduces the impact of a scripting flaw you have not found yet, and that is worth considerably more than the grade suggests.

The ones that change outcomes

• Content-Security-Policy, which restricts where scripts, styles and frames may load from. It is the only header on this list capable of limiting the damage of an injection, and the only one that takes real effort to deploy without breaking the site.
• Strict-Transport-Security, which removes the initial unencrypted request that downgrade attacks depend on, and which needs care because the instruction is cached by the browser for as long as you specify.
• X-Frame-Options, or the frame-ancestors directive that supersedes it, which is what prevents your interface being framed invisibly over somebody else’s page.
• X-Content-Type-Options, a single value that stops the browser second-guessing a declared content type and executing an uploaded file as script.

A content security policy containing unsafe-inline permits exactly the injection the policy was deployed to contain, which is why the grade a scanner awards and the protection actually achieved diverge so often.