0

Does any one know if:

  1. X-Frame-Options
  2. X-XSS-Protection
  3. X-Content-Type-Options
  4. Content-Security-Policy

are for HTTP and:

  1. Strict-Transport-Security
  2. Public-Key-Pins

are for HTTPS?

What I mean is that if I have a blog which serves pages on HTTP and has no HTTPS redirection, then only the first 4 headers are necessary. If I host it on HTTPS, only then the remaining 2 headers are necessary?

Or is it that they are required no matter how I host the blog?

  • 2
    These are all completely different headers and you could easily look up the purpose of each. Only the headers from your second list specifically refer to HTTPS, but the first list is relevant for HTTP and HTTPS likewise. – Arminius Aug 21 '17 at 20:23
2

If I host it on HTTPS, only then the remaining 2 headers are necessary?

No, that's not enough. Headers aren't mutually exclusive for HTTP or HTTPS.

HTTPS doesn't eliminate the vulnerabilities that some of the headers are meant to protect you against. E.g., the X-Frame-Optionsheader prevents cross-origin framing to stop clickjacking attacks. This risk is unrelated to an encrypted connection and makes sense for sites served over HTTP and HTTPS likewise.

Also, there are no "HTTPS headers", it's just that HSTS (Strict-Transport-Security) and HPKP (Public-Key-Pins) are HTTP headers that specifically instruct the browser how to behave for HTTPS connections.

[ ...] if I have a blog which serves pages on HTTP and has no HTTPS redirection, then only the first 4 headers are necessary.

Since HSTS instructs the browser to only connect over HTTPS for a given time and HPKP specifies public key hashes for the certificates that the browser should accept, you're correct that these two headers wouldn't make sense for a plain HTTP website. However, depending on your application, just setting the headers from your list won't guarantee you a secure website. I'd recommend you study each header's purpose and other possible measures to protect your site.

  • Gotcha! What if the blog uses HTTP to HTTPS redirection? How do we look at that case? – Metahuman Aug 21 '17 at 20:57
  • 2
    @Metahuman Then I would certainly go with HSTS to prevent downgrade attacks. – Arminius Aug 21 '17 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.