Instructing the browser.
WHAT HEADERS PROVIDE
Instructions to the browser about how to treat your site.
WHAT A CONTENT SECURITY POLICY DOES
Restricts what may execute and load.
WHY IT MATTERS
It limits the damage of a scripting vulnerability.
WHAT TO START WITH
A reporting-only policy, to see what would be blocked.
WHY
An overly strict policy breaks the site.
WHAT OTHER PROTECTIONS TO SET
Instructing browsers to use encryption only Preventing the site being embedded in frames elsewhere Preventing content type guessing Controlling what referrer information is sent Controlling which browser features may be used
WHY PREVENT FRAMING
It prevents an attack where your interface is invisibly overlaid on another page.
WHAT TO CHECK
What headers your site actually sends.
HOW
The network panel, or an external checking tool.
WHAT TO TEST AFTER SETTING THEM
The whole site, since restrictive policies break things subtly.
WHAT NOT TO DO
Set a permissive policy that permits everything.
WHY
It provides no protection while appearing to.
