Security · Advanced

Browser security: protections set in headers

In one line: A large share of client-side attacks are blocked by a few response headers and a few correct cookie settings.

Cookies

Mark them secure, inaccessible to script, and with a restrictive cross-site sending policy. Those three settings cover most session-theft and cross-site scenarios.

For state-changing actions, add a dedicated token or rely on a strict sending policy.

Content policy

A closed list of sources allowed to load scripts and styles. That's the strongest protection against running foreign code, and it takes patience to implement — start in report-only mode and collect violations before enforcing.

A few more

Enforcing encryption over time, preventing content-type guessing, restricting embedding in frames, and a referrer policy that doesn't leak internal addresses. All of these are configuration lines, not projects.

Going deeper

The content policy is hard to keep over time as you add third-party services. Document per allowed source who approved it and why, and review quarterly — a list that grows without control quietly loses its value.

Security