Lesson 2.8: Security headers
Response headers that tell the browser to defend the site's users: HSTS (always use HTTPS), Content-Security-Policy (which scripts may run), X-Frame-Options and frame-ancestors (no framing, against clickjacking), X-Content-Type-Options (no guessing of file types) and Referrer-Policy (what the next site learns). And the headers that only help attackers: version numbers. In the lab the shop sends none of the good ones and two of the bad ones. You add them in the nginx configuration, test it with nginx -t, see that nothing changes until nginx reloads, reload, and prove the result.
19 min
You will learn to
- Explain what HSTS, CSP, X-Frame-Options, X-Content-Type-Options and Referrer-Policy do
- Explain clickjacking
- Add response headers in nginx with add_header … always
- Test a configuration with nginx -t and apply it with a reload
- Remove version information from responses
Key terms
- HSTS
- Strict-Transport-Security: tells the browser to use only HTTPS for this site for the given time, even if someone types http://.
- Content Security Policy (CSP)
- A header listing where the page may load scripts, styles, images and frames from; the browser blocks everything else.
- Clickjacking
- Loading a site invisibly in a frame on another page so the visitor clicks its buttons without knowing.
- X-Content-Type-Options
- With the value nosniff it stops the browser from guessing a file's type from its content, so an uploaded text file is never run as a script.
- Referrer-Policy
- Controls how much of the current URL the browser sends to the next site in the Referer header.
- Reload
- Telling a running service to read its configuration again without stopping.
← IPv4 addresses, binary and the subnet mask · All lessons · Threat actors and their motives →