I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers (and other internet facing servers such as loadbalancers). But is this necessary for non internet facing servers?
Let's say you have an app running on
app.example.com on your local network, and you make it accessible on the internet through a reverse proxy on
web.example.com. I would set the headers on
app for a number of reasons:
- You want to keep application logic close to the app. The headers are not one size fits all. You need to understand what you are serving to know how to set them. Therefore it makes more sense to set them on
- Users on your intranet might browse directly to
app.example.com, either on purpose or by mistake. They should still get the proteciton.
- If an attacker knows the URL to
app.example.com, she could leverage it in an attack against users on your intranet. If she can't embed
web.example.comin an iframe on
evil.comfor her attack, she can just embed
If you have some minimum level of protection you want everything to have (perhaps you always want XSS proteciton to be on), you can set it on
web.example.com as well as an extra failsafe.