Contents
Intro
Continuing on from my previous blog about website security week, we're going to talk about a series of X- security headers.
These are set as headers on your site when it is served up, let's dive in!
X-Content-Type-Options
This header indicates that the browser should not try and sniff the type of the file served up. Sniffing of the file type would mean the browser modifying the Content-Type header that is returned from the server.
Sniffing the file content type could lead to non executable files being made executable, this could lead to bad actors injecting executable code into normal files and could lead to vulnerabilities.
Background on content sniffing.
It's best not to let the browser sniff the code.
Recommended setting:
X-Content-Type-Options: nosniff
You can read about it more on Modzilla.
X-XSS-Protection
This header has mostly been superseeded by the Content Security Policy, however its still useful for old browsers.
This header can be set so browsers detect XSS (Cross Site Scripting) and block loading of resources once a Cross Site Scripting attack has been detected.
Recommended setting:
X-XSS-Protection: 1; mode=block
You can read about it more on Modzilla.
X-Frame-Options
This header has mostly been superseeded by the Content Security Policy, however its still useful for old browsers.
This indicates if the site can be loaded in a <frame>, <iframe>, <embed> or <object>.
Use this header to ensure you site and content cannot be embedded in someone elses site, this is commonly referred to click jacking attack.
Recommended setting:
X-Frame-Options: DENY
You can read about it more on Modzilla.
Summary
In summary, setting a few additional headers when serving up your site can really improve the security of your site. It reduces the amount of attack surface there is for attackers and prevent common attacks on websites.
Set those headers now!
Happy Building!
This may be a silly question, but I am a beginner, beginner to web development and want to start good web security practices now. How exactly do I go about changing these policies for the header? Or can you point me in the right direction?