Are HTTP security headers only for web browsers?

Question

There are some HTTP security headers in the world of cyber security of web applications. These are e.g.:

• X-Content-Type-Options
• X-Frame-Options
• Content-Security-Policy
• Referrer-Policy
• Strict-Transport-Security
• Expect-CT
• X-XSS-Protection (deprecated)
• etc.

All of them are instructions for web browsers as far as I know. When a web browser takes this instruction that comes from HTTP response packet of web application server, it behaves according to related to HTTP security header's job on the "client side". All is fine. But, the thing which I wonder is:

When these HTTP security headers are used in a web service server instead of a web application server (e.g. SOAP web service server, or REST API web server), these security headers are still functional to use?

For instance; if the consumer of a web service server is a web application, then the client is web browser. Then are these security headers functional in this situation or redundant?

Or is it like that: the consumer of a web service doesn't matter, all these HTTP security headers are functional in just web applications?

Shortly, are HTTP security headers only for web browsers? This question's answer will clarify the situation. If question's answer is yes, then HTTP security headers are functional when a web service consumer is an web application, right?

Answer 1

Each HTTP security header is designed to improve the security in specific use cases.

Many of these headers make only sense for use within a browser (or browser-like thing) since the relevant use cases cover only what browsers do - like integrating content from multiple sites, executing Javascript, following clicks of the user etc. These are headers like Content-Security-Policy, X-Frame-Options or Referrer-Policy.

Some use cases for the headers also make sense outside of browsers, like Strict-Transport-Security. They are still mostly not implemented outside of browsers since they are usually not considered sufficient relevant for the specific tasks these non-browser tools or libraries are used for. But sometimes these headers are implemented, like curl supporting Strict-Transport-Security.