HTTP security headers su ne response headers da suka ba da umarnin ga browsers su shikar da security protections — tuna da taimakawa wajen tsare daga attacks kamar XSS, clickjacking, da protocol downgrade. Suna da sauƙi, muhimmi layer na karewa ga web applications.
Key security headers
CONTENT-SECURITY-POLICY (CSP) → controls what resources/scripts can load/run → a strong
defense against XSS (restrict script sources; block inline scripts) — the most powerful
STRICT-TRANSPORT-SECURITY (HSTS) → force HTTPS (browser refuses HTTP) → prevents
downgrade/SSL-stripping attacks
X-CONTENT-TYPE-OPTIONS: nosniff → stop MIME-type sniffing (prevents some attacks)
X-FRAME-OPTIONS / CSP frame-ancestors → prevent CLICKJACKING (block embedding in iframes)
REFERRER-POLICY → control how much referrer info is sent (privacy)
PERMISSIONS-POLICY → control access to browser features (camera, geolocation, etc.)
