Skip to content

Instantly share code, notes, and snippets.

@devlinjunker

devlinjunker/-webapp-headers

Last active October 8, 2020 22:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save devlinjunker/b01e39e030b92252b61bf222ac8954a0 to your computer and use it in GitHub Desktop.
Save devlinjunker/b01e39e030b92252b61bf222ac8954a0 to your computer and use it in GitHub Desktop.
Download ZIP
Expected Security Headers for Web App
Raw
-webapp-headers
Response Headers we should set with webapps
Strict-Transport-Security
X-Content-Type-Options
X-Frame-Options
X-XSS-Protection
TODO:
Content-Security-Policy
Raw
nginx.conf
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header X-XSS-Protection "1" always;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment