5

Let's say, the HTTP security headers below are applied to all HTML pages of a site:

  • HTTP Strict Transport Security (HSTS)
  • X-Frame-Options (XFO)
  • X-XSS-Protection
  • X-Content-Type-Options

Is it OK to not put those HTTP security headers on non HTML resources (images, JavaScript files, etc) but those headers are applied to all HTML resources.

Any security risks for that?

Improve this question

1 Answer 1

Reset to default
1

Depends. If the website accepts user-submitted content, it's best to keep the XSS and nosniff headers on, in case they provide a loophole.

Lack of HSTS is also fine; however ensure that you have your cookies separated from HTTP and HTTPS, just in case.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .