Vertex

HTTPS, security headers, and CSP

A handful of response headers remove entire attack classes. CSP is the strongest and the fiddliest, so roll it out in report-only first.

Lesson 4.18m 6sIntermediate7.1k students

Chapters

8:06
  1. 0:00Why Headers Matter for Web App Security
  2. 0:47What Are HTTP Secure Headers?
  3. 1:20Content-Security-Policy (CSP
  4. 2:10HSTS (Strict-Transport-Security
  5. 3:11X-Content-Type-Options
  6. 4:13Referrer-Policy
  7. 5:17CORS (Cross-Origin Resource Sharing
  8. 6:52Permissions-Policy
  9. 7:56Wrap-up: Secure Your App by Default

What this lesson covers

  • Enforce HTTPS and enable HSTS
  • Set the headers that block framing and sniffing
  • Introduce a content security policy incrementally

This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will

  • Enforce HTTPS and enable HSTS
  • Set the headers that block framing and sniffing
  • Introduce a content security policy incrementally

Resources

Previous lessonMFA and delegated authentication3.3 · 4m 32sNext lessonSecrets management4.2 · 18m 45s