Which security Headers for HTTPS?

Question

I implement a server application in .NET. I just want to know which security headers I need to set if I use HTTPS. I know about the HttpOnly and SameSite Cookies. OWASP has a recommendation HTTP Headers Cheat Sheet but do I need every single one? Is there something like a standard? Which are the most important?

Answer 1

The most important are:

• Content-Type
• Strict-Transport-Security
• Content-Security-Policy

Some in your link are now deprecated:

• X-XSS-Protection - no modern browsers implement this; CSP provides XSS protection instead
• X-Frame-Options - use the CSP frame-ancestors directive instead
• X-Content-Type-Options - modern browsers don't need this, provided you specify a Content-Type
• Public-Key-Pins - no modern browsers implement this, it was considered dangerous for inadvertently DoSing a domain.

Some do specific things:

• Access-Control-Allow-Origin (and related like Access-Control-Allow-Credentials) - these can be important if you need cross-domain requests, but can also be dangerous. Don't use them unless you know what you're doing.

Some allow advanced security, so they can improve your security, but I wouldn't say they are needed.

• Permissions-Policy
• Cross-Origin-Resource-Policy

Answer 2

It's impossible to say whether you "need" all of those headers, or which are the "most important" without a full understanding of your application and your threat model. For instance, you might be perfectly fine with other sites loading yours inside an IFRAME, or you might consider that a serious security problem.

So the best advice we can really give would be to read the recommendations in the OWASP Cheat Sheet, and then apply them to your specific use-case. And if you can't implement a specific recommendation, then you should assess the risk that it's intended to address, and if necessary implement some additional compensating controls to protect your site.