HTTP security headers ऐसे response headers हैं जो browsers को सुरक्षा सुरक्षाएं लागू करने का निर्देश देते हैं — XSS, clickjacking, और protocol downgrade जैसे attacks के विरुद्ध बचाव में मदद करते हैं। ये web applications के लिए बचाव की एक आसान, मूल्यवान परत हैं।
प्रमुख security headers
CONTENT-SECURITY-POLICY (CSP) → controls what resources/scripts can load/run → a strong
defense against XSS (restrict script sources; block inline scripts) — the most powerful
STRICT-TRANSPORT-SECURITY (HSTS) → force HTTPS (browser refuses HTTP) → prevents
downgrade/SSL-stripping attacks
X-CONTENT-TYPE-OPTIONS: nosniff → stop MIME-type sniffing (prevents some attacks)
X-FRAME-OPTIONS / CSP frame-ancestors → prevent CLICKJACKING (block embedding in iframes)
REFERRER-POLICY → control how much referrer info is sent (privacy)
PERMISSIONS-POLICY → control access to browser features (camera, geolocation, etc.)
