Should HTTP Security headers be configured for all servers?

Question

I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers (and other internet facing servers such as loadbalancers). But is this necessary for non internet facing servers?

Answer 1

Let's say you have an app running on app.example.com on your local network, and you make it accessible on the internet through a reverse proxy on web.example.com. I would set the headers on app for a number of reasons:

• You want to keep application logic close to the app. The headers are not one size fits all. You need to understand what you are serving to know how to set them. Therefore it makes more sense to set them on app.example.com.
• Users on your intranet might browse directly to app.example.com, either on purpose or by mistake. They should still get the proteciton.
• If an attacker knows the URL to app.example.com, she could leverage it in an attack against users on your intranet. If she can't embed web.example.com in an iframe on evil.com for her attack, she can just embed app.example.com instead.

If you have some minimum level of protection you want everything to have (perhaps you always want XSS proteciton to be on), you can set it on web.example.com as well as an extra failsafe.