I have just tested google on securityheaders.io and the result was D.

Google is actually not setting following security headers

  • Content-Security-Policy
  • X-Content-Type-Options
  • Referrer-Policy

I always considered Google as leader in many security areas. The above headers are part of usual defence in depth practice.

Could anybody provide some rationale behind this? Why google is not implementing them?

  • Possibly because neither of those 3 are in standard http header – Sefa Nov 24 '17 at 13:25
  • 1
    maybe because your assessing a Search engine page, An accounts page like myaccount.google.com Scores an A see schd.io/12Q – LvB Nov 24 '17 at 14:57
  • 1
    @sefa - I agree that X-Content-Type-Options is not standard but the other two are defined by www.w3c.org – mybrave Nov 24 '17 at 15:34
  • i may be mistaking but i'm pretty sure that RFC 2616 section 14 has not been obsoleted yet, making the three not standard – Sefa Nov 24 '17 at 15:42
  • 3
    @Sefa: Who cares if these headers are defined in RFC 2616 or if these are otherwise "standard" headers. The only relevant thing is that the browsers implement these. Apart from that none of CORS, WebSockets, Content-Security-Policy etc is defined in RFC 2616 but they are often defined as separate IETF RFC or W3C recommendations. And sometimes they are just "defined" because they are implemented in browsers (X-Content-Type-Options). Apart from that Google uses several "non-standard" headers already like X-XSS-Protection or X-Frame-Options. – Steffen Ullrich Nov 24 '17 at 16:04

Defining a good Content-Security-Policy for an existing complex application is often non-trivial. It's safe to say that efforts are underway to deploy CSP at Google, but imagine the cost of potential breakages on such a site. Also keep in mind that some users would not benefit from a CSP, due to using older browsers, so other defenses must still exist.

Referrer-policy is actually undesirable on a search engine. Many web site operators use the referrer to determine what keywords were used to access their site, which helps optimize their site content and better understand their userbase to generate more relevant content.

X-Content-Type-Options is not used for most browsers, and even when it is, it only matters if an attacker can control a significant part of the beginning of the response.

I understand the principles of defense in depth, but obviously security doesn't exist in a vacuum and has to consider operational and business aspects. As @LvB pointed out, security headers on a search page are very different from properties with higher sensitivities, such as accounts.google.com and mail.google.com, both of which score an A.

(All of this is just speculation and I don't know what the official answer is.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.