Security headers: Are they needed on subsequent requests (eg. Scripts, Images) after they have been sent on the main HTML request?

Question

I had a discussion with PenTesters at my company today, who have said that security headers, like for example Content-Security-Policy, Strict-Transport-Security, Referrer-Policy and Permissions-Policy, should always be sent in the subsequent requests within one page (e.g. Images, Angular), even if they were sent already with the main request (in our case a JSF page).

My understanding was always that those things are inherited from the main request to the subsequent request and they don't add any security if sent with those.

Apart from the argument that they do not add much in size, is there any reason to include them in the subsequent request? From the point of view of user security or exploitability? I wasn't able to think up a reason why they should be included.

Example of the network trace:

https://somehost/request.jsf -> headers sent
https://somehost/angular-package.js -> no headers sent
https://somehost/logo.png -> no headers sent
https://somehost/font1.woff -> no headers sent

-- User navigates to another page --

https://somehost/request2.jsf -> headers sent
https://somehost/angular-package.js -> no headers sent
https://somehost/additionalImage.png -> no headers sent

Answer 1

The best practice is to send them on all file types. It is true that at least Content-Security-Policy is relevant only to documents, but a document can be an XML file or an SVG image (which is an XML document) as well as a regular HTML page. I'm not sure if the in-browser PDF viewer is affected by Content-Security-Policy, but if so, that would be a file type to include as well. If you include them on all requests, then you don't have to enumerate all possible file types, which is likely to lead you to leave out something important which may be security sensitive. Some browsers also do content-type sniffing and therefore may think something is a document when it is not, which could also lead to a security-sensitive situation if you don't include the headers on all requests.

For Strict-Transport-Security, it should always be sent on all pages, since a user may access a link to a specific resource (e.g., an image) and once that's done over a secure channel, then subsequent requests will always be secure.