Difference between revisions of "User:Pawel Krawczyk/List of useful HTTP headers"

From OWASP
Jump to: navigation, search
m
 
(3 intermediate revisions by one user not shown)
Line 1: Line 1:
This page lists useful security-related HTTP headers. In most web application frameworks HTTP headers can be set in web server configuration, without changing actual application's code. This is often significantly faster and cheaper solution for at least partial mitigation of existing issues, and a quick additional layer of defense for new applications.
+
This page lists useful security-related HTTP headers. In most architectures these headers can be set in web server configuration ([http://httpd.apache.org/docs/2.0/mod/mod_headers.html Apache], [http://technet.microsoft.com/pl-pl/library/cc753133(v=ws.10).aspx IIS]), without changing actual application's code. This offers significantly faster and cheaper method for at least partial mitigation of existing issues, and an additional layer of defense for new applications.
  
 
{| border="1"
 
{| border="1"
Line 8: Line 8:
 
|-
 
|-
 
|[http://tools.ietf.org/html/rfc6797 Strict-Transport-Security]
 
|[http://tools.ietf.org/html/rfc6797 Strict-Transport-Security]
|Complying user agents are to interact with this server using only secure HTTP connections (HTTP over TLS/SSL).
+
|Enforces secure (HTTP over SSL/TLS) connections to the server. This reduces impact of bugs in web applications leaking session data through cookies and external links.
 
|<code>Strict-Transport-Security: max-age=16070400; includeSubDomains</code>
 
|<code>Strict-Transport-Security: max-age=16070400; includeSubDomains</code>
 
|-
 
|-
Line 16: Line 16:
 
|-
 
|-
 
| [http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx X-XSS-Protection]
 
| [http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx X-XSS-Protection]
| [[Cross-site scripting]] (XSS) filter
+
| This header enables [[Cross-site scripting]] (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so role of this headers is to re-enable for this particular website if it was disabled by the user.
 
| <code>X-XSS-Protection: 1; mode=block</code>
 
| <code>X-XSS-Protection: 1; mode=block</code>
 
|-
 
|-
 
| [http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx X-Content-Type-Options]
 
| [http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx X-Content-Type-Options]
| The only defined value, "nosniff", prevents Internet Explorer and Google Chrom from MIME-sniffing a response away from the declared content-type. This also applies to [http://code.google.com/chrome/extensions/hosting.html Google Chrome], when downloading extensions.
+
| The only defined value, "nosniff", prevents Internet Explorer and Google Chrom from MIME-sniffing a response away from the declared content-type. This also applies to [http://code.google.com/chrome/extensions/hosting.html Google Chrome], when downloading extensions. This reduces exposure to drive-by download attacks and sites serving user uploaded content that, by clever naming, could be treated by MSIE as executable or dynamic HTML files.
 
| <code> X-Content-Type-Options: nosniff </code>
 
| <code> X-Content-Type-Options: nosniff </code>
 
|-
 
|-
 
|[http://www.w3.org/TR/CSP/ X-Content-Security-Policy, X-WebKit-CSP]
 
|[http://www.w3.org/TR/CSP/ X-Content-Security-Policy, X-WebKit-CSP]
|[[Content Security Policy]] definition. Requires careful tuning and precise definition of the policy. If enabled CSP has significant impact on the way browser renders pages (e.g. inline JavaScript disabled by default and must be explicitly allowed in policy).
+
|[[Content Security Policy]] definition. Requires careful tuning and precise definition of the policy. If enabled CSP has significant impact on the way browser renders pages (e.g. inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including [[Cross-site Scripting]] and other cross-site injections.
 
|<code>X-WebKit-CSP: default-src 'self'</code>
 
|<code>X-WebKit-CSP: default-src 'self'</code>
 
|}
 
|}
Line 55: Line 55:
 
  '''x-frame-options:''' SAMEORIGIN
 
  '''x-frame-options:''' SAMEORIGIN
 
  '''x-xss-protection:''' 1; mode=block
 
  '''x-xss-protection:''' 1; mode=block
 
<reflist/>
 

Latest revision as of 09:15, 22 January 2013

This page lists useful security-related HTTP headers. In most architectures these headers can be set in web server configuration (Apache, IIS), without changing actual application's code. This offers significantly faster and cheaper method for at least partial mitigation of existing issues, and an additional layer of defense for new applications.

Field name Description Example
Strict-Transport-Security Enforces secure (HTTP over SSL/TLS) connections to the server. This reduces impact of bugs in web applications leaking session data through cookies and external links. Strict-Transport-Security: max-age=16070400; includeSubDomains
X-Frame-Options, Frame-Options Clickjacking protection. Values: deny - no rendering within a frame, sameorigin - no rendering if origin mismatch, allow-from: URL - allow rendering frame if loaded from URL X-Frame-Options: deny
X-XSS-Protection This header enables Cross-site scripting (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so role of this headers is to re-enable for this particular website if it was disabled by the user. X-XSS-Protection: 1; mode=block
X-Content-Type-Options The only defined value, "nosniff", prevents Internet Explorer and Google Chrom from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions. This reduces exposure to drive-by download attacks and sites serving user uploaded content that, by clever naming, could be treated by MSIE as executable or dynamic HTML files. X-Content-Type-Options: nosniff
X-Content-Security-Policy, X-WebKit-CSP Content Security Policy definition. Requires careful tuning and precise definition of the policy. If enabled CSP has significant impact on the way browser renders pages (e.g. inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site Scripting and other cross-site injections. X-WebKit-CSP: default-src 'self'


Real life examples

Below examples present selected HTTP headers as set by popular websites to demonstrate that they are indeed being used in production services:

Facebook

As of January 2013 Facebook main page was setting these security related HTTP headers.

Strict-Transport-Security: max-age=60
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-WebKit-CSP: default-src *; script-src https://*.facebook.com
  http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net
  *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:*
  'unsafe-inline' 'unsafe-eval' https://*.akamaihd.net http://*.akamaihd.net;
  style-src * 'unsafe-inline'; connect-src https://*.facebook.com http://*.facebook.com
  https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.spotilocal.com:*
  https://*.akamaihd.net ws://*.facebook.com:* http://*.akamaihd.net;
X-XSS-Protection: 1; mode=block

Especially interesting is Facebook's use of Content Security Policy (using Google Chrome syntax), whose implementation can be challenging for large sites with heavy usage of JavaScript.

Google+

As of January 2013 Google+ main page was setting these security related HTTP headers:

x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block