Antetele de securitate HTTP sunt antetele de răspuns care instruiesc browserele să aplice protecții de securitate — ajutând la apărarea împotriva atacurilor precum XSS, clickjacking și downgrade-ul protocolului. Sunt un strat ușor și valoros de apărare pentru aplicațiile web.
Antetele de securitate cheie
CONTENT-SECURITY-POLICY (CSP) → controls what resources/scripts can load/run → a strong
defense against XSS (restrict script sources; block inline scripts) — the most powerful
STRICT-TRANSPORT-SECURITY (HSTS) → force HTTPS (browser refuses HTTP) → prevents
downgrade/SSL-stripping attacks
X-CONTENT-TYPE-OPTIONS: nosniff → stop MIME-type sniffing (prevents some attacks)
X-FRAME-OPTIONS / CSP frame-ancestors → prevent CLICKJACKING (block embedding in iframes)
REFERRER-POLICY → control how much referrer info is sent (privacy)
PERMISSIONS-POLICY → control access to browser features (camera, geolocation, etc.)
