I feel like there's a lot of variation in the suggested HTTP headers.

Commonly I see suggestions for:

  • HTTP Strict Transport Security
  • Content Security Policy
  • X-Frame-Options (Same Origin)
  • X-Xss-Protection (block)
  • X-Content-Type-Options (nosniff)

The use of which headers do you generally advise? And as a follow up question: Do the suggested headers for REST APIs differ?

  • 1
    you use the headers that you need to - I think you need to do some more research on the topic – schroeder Mar 12 '17 at 14:18
  • 1
    @schroeder The question is about optional HTTP headers that increase security, I don't think that it is off-topic, as it is about web security. I also do not think that it would eg be too broad (there are really only a handful of recommended headers, and each can be described - what it does, when (not) to use it - in a sentence or two). There are also reliable sources that can help answer this question, such as OWASP – tim Mar 12 '17 at 14:41
  • 1
    @OP: I think though that you should focus your question on one topic. Either ask about what headers exist, or ask if the generally recommended headers are also appropriate for a REST API. – tim Mar 12 '17 at 14:43
  • 1
    The problem is that those headers are designed to tackle vastly different problems, which means you wouldn't use all of them for every site. You've provided a fruit salad and are asking if the apple is more common than orange in other people's salads. And to extend the analogy further, then you ask if an electrician would enjoy the salad. The question is off-topic because it is too broad. If you just want to know what the headers do, then that is also off-topic as a simple web search. – schroeder Mar 12 '17 at 15:34
  • 1
    @schroeder The header do very different things, but there is a common theme. They are all response header which can/should/are applied site-wide and have a positive impact on security. The amount is limited, so it's not too borad. A simple google search shows that OP is not the only one grouping these together (OWASP, Spring, or KeyCDN have articles on this, Apache Tomcat has its own filter class for exactly this purpose, etc). I agree that the information is easily available elsewhere, but I do not think that that is a valid close reason – tim Mar 12 '17 at 16:24

Browse other questions tagged or ask your own question.