Security Headers & CSP
When to use this skill
-
Configuring web servers (Nginx, Caddy, Apache).
-
Setting up middleware (Laravel, Express, Django).
-
Auditing site security.
- Essential Headers
-
HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
-
No Sniff: X-Content-Type-Options: nosniff .
-
Frame Options: X-Frame-Options: DENY or SAMEORIGIN .
- Content Security Policy (CSP)
-
Default: Start with default-src 'self' .
-
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval' . Use nonces or hashes if inline scripts are necessary.
-
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only ).
- CORS
-
Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
-
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.