Configuring HTTP Security Headers

HTTP Strict-Transport-Security (HSTS) is a header that instructs browsers to connect to the site only using HTTPS, even if HTTP was chosen. Browsers will transparently upgrade all requests to HTTPS for sites that provide HSTS. Furthermore, it instructs browsers to disable user’s ability to by-pass certificate related errors while accessing your site.

X-Frame-Options (XFO) is a header that instructs the browser whether or not it can render a page in a frame. A frame includes <frame>, <iframe>, <embed> or <object> elements. This header is primarily intended to protect your site from click-jacking attacks.

Browsers that support Content-Security-Policy (CSP) header’s frame-ancestors directive would ignore the XFO header. However, I recommend keeping the XFO header to protect users on older browser or browsers that don’t support frame-ancestors.

This header instructs browsers that MIME types specified in Content-Type headers by your server is accurate and should not be changed. Sometimes, browsers might read parts of a file served by your server — called MIME-type sniffing — to determine what type of file it is. This header mitigates vulnerabilities in browsers while reading the file by opting-out of MIME-type sniffing.

This header also enables Cross-Origin Read Blocking (CORB) protection for certain MIME-types.⁠^[5]

All modern web servers are pre-configured to correctly advertise MIME types for most common file formats. Nginx has a configurable MIME-type list in /etc/nginx/mime.types, which you should ensure contains valid MIME types for all files served by your site.

This header was introduced by Internet Explorer, Chrome and Safari to prevent browsers from loading the page when they detect a cross-site scripting attack. This header has since been deprecated and replaced by the CSP header. However, it is still a good practice to include this header to support users on older browsers that do not support CSP.

Since this security header is deprecated and blocking XSS attacks is the most suitable option for most users, I won’t explain the other options here. If you’re interested, please read Mozilla’s documentation on XSS filtering to know more.

Content Security Policy (CSP) is a header that helps browsers detect and mitigate certain attacks like Cross-Site Scripting (XSS) and data injection attacks. This is a complicated security header to set up as it has many options, some of which are may require difficult and tedious changes to your site.

Most of the policies involve specifying the server origin and resource endpoints. CSP allows fine-grained control of what resources the user’s browsers is allowed to load for the page. Sites that have complicated resource requirements can customize their CSP on a per-page basis. I’ll cover the basic syntax and some of the important directives.

Each <directive> <value> pair is a policy. You can specify multiple policies in a single header. You can also provide multiple CSP headers (including specifying some directives using the <meta> tag in pages). But to keep things simple, I recommend using a single CSP header as far as possible. If for some reason, you need to use multiple CSP headers, remember that CSP headers can specify new policies but can’t undo or ease restrictions imposed by policies from previous CSP headers.

The following is secure CSP header that is suitable for static websites that don’t use scripts, self-hosts resources (images, fonts etc.) and don’t use frames. I use Nginx variables to keep the length of lines manageable.

Explaining all CSP policies is beyond the scope of this article. Please refer to Mozilla’s CSP documentation for the complete list of policies.

HTTP requests often include an optional header called Referer, which contains the origin (URL) the request was made from. The Referrer-Policy security header restricts the data exposed via the Referer header. It’s useful to prevent exposing sensitive data (such as usernames, session IDs, email address etc.) from URLs on your site to unintended destinations.

When no Referrer-Policy is specified, the default behavior of the browser is used. It’s therefore advisable to explicitly specify the policy since defaults can vary from one browser to the next.

A URL is composed of the scheme, origin, path and query string. For instance, for the URL https://example.com/some/dir?user=john, the scheme is HTTPS, the origin is example.com, the path is some/dir and the query string is user=john.

The scheme is implicitly included when transmitting any other part of the URL. The scheme is said to be “downgraded” when the protocol security level is lowered (i.e., from HTTPS to HTTP) when visiting the destination.

Let’s examine the options available for restricting referrer information.

Permissions-Policy, formerly known as Feature-Policy, is a security header that instructs browsers whether the page can make use of various browser or device features. For instance, if the page doesn’t need access to the microphone, you can explicitly instruct the browser to prevent any part of the page from accessing the user’s microphone.

The full list of features supported by Permissions-Policy is rather extensive and likely to grow over time. Even if you don’t specify all of them, at least include the ones you think lead to the most egregious violations of a user’s privacy or security.

This header specifies how cross-domain requests to your site’s resources are handled when initiated from web clients like Adobe Flash, Adobe Acrobat etc. Implement this header to restrict loading of your site’s resources from other domains via these clients.

Normally the policy is specified in a master policy XML file at the root directory of your domain. However, if you can’t write to the root directory or as a matter of convenience, you can declare this policy using the X-Permitted-Cross-Domain-Policies header. For more information, read Adobe’s Cross domain workflow.

In most cases you would want to prevent loading resources to prevent cross-domain resource abuse. This is done by using none as shown in the examples above. The other available options are any one of the following.