5

Let's say, the HTTP security headers below are applied to all HTML pages of a site:

  • HTTP Strict Transport Security (HSTS)
  • X-Frame-Options (XFO)
  • X-XSS-Protection
  • X-Content-Type-Options

Is it OK to not put those HTTP security headers on non HTML resources (images, JavaScript files, etc) but those headers are applied to all HTML resources.

Any security risks for that?

1

Depends. If the website accepts user-submitted content, it's best to keep the XSS and nosniff headers on, in case they provide a loophole.

Lack of HSTS is also fine; however ensure that you have your cookies separated from HTTP and HTTPS, just in case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.