Apa iku HTTP security headers?

Question

Accepted Answer

**HTTP security headers** yaiku response headers sing memerintahke browser supaya nglakokake proteksyon keamanan — membantu membela dhiri saka serangan kaya XSS, clickjacking, lan protocol downgrade. Iki minangka lapisan pertahanan sing gampang lan berharga kanggo aplikasi web.

## Key security headers

```text
CONTENT-SECURITY-POLICY (CSP) → controls what resources/scripts can load/run → a strong
  defense against XSS (restrict script sources; block inline scripts) — the most powerful
STRICT-TRANSPORT-SECURITY (HSTS) → force HTTPS (browser refuses HTTP) → prevents
  downgrade/SSL-stripping attacks
X-CONTENT-TYPE-OPTIONS: nosniff → stop MIME-type sniffing (prevents some attacks)
X-FRAME-OPTIONS / CSP frame-ancestors → prevent CLICKJACKING (block embedding in iframes)
REFERRER-POLICY → control how much referrer info is sent (privacy)
PERMISSIONS-POLICY → control access to browser features (camera, geolocation, etc.)
```

## Example

```text
Content-Security-Policy: default-src 'self'; script-src 'self'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
```

## Why they matter (defense in depth)

```text
✓ EASY to add (configure on the server/proxy) → significant protection for little effort
✓ DEFENSE IN DEPTH → an extra layer (e.g. CSP mitigates XSS even if escaping is missed)
✓ CLICKJACKING protection (X-Frame-Options), forced HTTPS (HSTS), etc.
⚠️ Not a substitute for secure coding (fix the root causes too); CSP needs careful config
→ A valuable, low-effort security improvement for web apps. (Tools/scanners check these.)
```

## Apa iku sing penting

Nemahami HTTP security headers iku berharga amarga menehi **lapisan pertahanan sing gampang lan efektif kanggo aplikasi web**, dadi dadi ilmu keamanan praktis sing berguna.

Security headers memerintahke browser supaya nglakokake proteksyon saka serangan umum, lan nemahami sing utama iku berharga. **Content-Security-Policy (CSP)** sing paling kuat — ngontrol resource lan script apa sing bisa dimuat lan balun, menehi pertahanan sing kuwat saka XSS (malah mitigasi yen output escaping dilewatke). **Strict-Transport-Security (HSTS)** makso HTTPS, nyegah downgrade lan SSL-stripping attacks. **X-Frame-Options** (utawa CSP frame-ancestors) nyegah **clickjacking** karo ngeblok halaman saka embed ing iframes. **X-Content-Type-Options: nosniff**, Referrer-Policy, lan Permissions-Policy nambah proteksyon liyane.

Nemahami headers iki lan apa sing padha proteksi yaiku ilmu praktis.

Nemahami **apa iku sing penting** yaiku nilai kunci: iku **gampang ditambah** (dikonfigurasi ing server/proxy) nanging menehi proteksyon signifikan kanggo usaha sithik, lan iku nglakokake **defense in depth** (lapisan tambahan — contone CSP mitigasi XSS sanajan coding mistake ngidini iku).

Nemahami caveat penting yen **headers dudu pengganti kanggo secure coding** (sampeyan kudu isih ngembenake root causes; CSP kudu konfigurasi kanthi hati-hati) ngrembaka pemahaman sing seimbang — headers nambah, ora ganti, pengembangan aman.

Security headers yaiku perbaikan berharga lan usaha sithik sing akeh sites ora nggunakake, lan tools/scanners biasane ngecek supaya.

Lawas security headers menehi pertahanan gampang lan efektif-in-depth kanggo aplikasi web (proteksi saka XSS, clickjacking, downgrade attacks) kanggo usaha sithik, lan amarga nemahami headers utama lan nilai padane yaiku berguna kanggo nambah web app security, nemahami HTTP security headers yaiku berharga, ilmu keamanan praktis sing relevan — lapisan pertahanan web usaha sithik-berharga tinggi (special CSP kanggo XSS lan X-Frame-Options kanggo clickjacking) sing nambah secure coding, ilmu berguna kanggo hardening aplikasi web.