Protecting the browser, an HTTP security header overview

Security learning

Traditionally, web security has concentrated on fortifying the server side—protecting the application itself from attacks. This approach, while necessary, often overlooks a critical aspect of web security: the client side. Client-side attacks, where the user's browser becomes the battleground, can have devastating impacts on businesses.

Take, for instance, the notorious Magecart attacks. These involve hackers injecting skimming scripts into websites to steal sensitive customer information, such as credit card details, directly from the user's browser. Similarly, session hijacking and Cross-Site Scripting (XSS) attacks exploit vulnerabilities in the browser, leading to unauthorized access and data breaches. Such attacks don't just risk user data; they can erode trust, tarnish reputations, and result in significant financial and legal repercussions for businesses.

HTTP security headers are vital tools in combating these type of attacks. Properly implemented, they instruct browsers on how to safely handle website content and interactions.

Key HTTP Security Headers

Content-Security-Policy (CSP)

Purpose: CSP prevents Cross-Site Scripting (XSS) attacks by specifying which sources browsers should allow for loading scripts, images, and other resources. It can also prevent MageCart style attacks by restricting the host names that an injected script can communicate with.

Content-Security-Policy: script-src 'self' https://apis.google.com;

This example allows scripts to be loaded from the site's own domain ('self') and https://apis.google.com only.

X-Frame-Options

Purpose: This header protects against clickjacking attacks by controlling whether a browser should allow a page to be rendered in a <frame>, <iframe>, <embed>, or <object>.

X-Frame-Options: DENY

This setting prevents any domain from framing the content. Another option is SAMEORIGIN, which only allows framing by the same site.

X-Content-Type-Options

Purpose: This header prevents MIME-sniffing, where a browser might incorrectly interpret the content type of a resource, leading to security vulnerabilities.

X-Content-Type-Options: nosniff

This instructs the browser to strictly adhere to the content type declared in the HTTP headers.

X-XSS-Protection

Purpose: It enables the browser's inbuilt XSS protection features. However, this header is largely deprecated in favor of CSP.

X-XSS-Protection: 1; mode=block

This configuration enables the protection and instructs the browser to block the page if an XSS attack is detected.

Strict-Transport-Security (HSTS)

Purpose: HSTS forces the browser to use HTTPS over HTTP, ensuring encrypted communication and protecting against man-in-the-middle attacks. Alternatively you can automatically redirect all requests to HTTPS on your webserver or at your EDGE provider. For example Peakhour allows you to set up EDGE redirects to easily force all traffic to HTTPS.

Strict-Transport-Security: max-age=31536000; includeSubDomains

This example tells the browser to use HTTPS for all subdomains for one year.

Conclusion

Implementing correct HTTP security headers is a straightforward yet powerful method to enhance the security of web applications. These headers are essential in forming the first line of defense against many common security vulnerabilities. As threats evolve, maintaining updated and properly configured security headers is key to safeguarding your users and your brand.

Security learning