← Web Application Security tutorial
Web Application Security
HTTPS & Secure Headers
HTTPS encrypts everything sent between a browser and a server, so anyone intercepting the traffic (on public WiFi, for instance) sees scrambled bytes, not passwords or session cookies in plain text. There's no good reason for any modern site to serve sensitive pages over plain HTTP.
A handful of response headers close off attacks HTTPS alone doesn't cover:
Content-Security-Policy: default-src 'self'
# Tells the browser to only run scripts/styles from this site's own origin,
# a strong second layer of defense against XSS even if some input escapes.
X-Content-Type-Options: nosniff
# Stops the browser from guessing a file's type, which can be tricked into
# running an uploaded file as a script instead of serving it as plain data.
Strict-Transport-Security: max-age=63072000
# Tells the browser to only ever reach this site over HTTPS, even if a
# user types "http://" or clicks an old plain-HTTP link.None of these headers are a complete defense on their own — they're layers. Each one closes off a specific way an attacker could otherwise abuse the browser, even against a site that's already doing input validation correctly elsewhere.