Questions tagged [header]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
7
votes
3answers
9k views

Does the X-Permitted-Cross-Domain-Policies header have any benefit for my website if I'm not using Adobe products?

OWASP says the X-Permitted-Cross-Domain-Policies security header gives web clients "permission to handle data across domains". It specifically states that Adobe's Flash Player and Acrobat PDF Reader ...
9
votes
2answers
2k views

How does sending referrer HTTP headers protect against CSRF attacks?

How does sending referrer HTTP headers protect against CSRF attacks? I tried logging into an HTTPS site with Firefox's network.http.sendRefererHeader set to 0 (i.e., completely disabled, as a measure ...
0
votes
1answer
269 views

What is an exploitation schema in this XSS attack? [duplicate]

Basically, I've found an XSS injection by changing the payload with the X-Forwarded-Host header, since its value is reflected in the document and is not sanitized. An example, this is the document ...
150
votes
4answers
23k views

Which security measures make sense for a static web site?

I have a static web site. Users cannot log in or perform any other actions. Which of the common HTTP security measures make sense for my site? Do I need any of these? HTTPS Strict transport security ...
4
votes
2answers
9k views

Is the Origin header really useful for securing a WebSocket?

I've been reading some posts about WebSockets security, and a few of them mention to use the Origin header for helping secure the connection. For example this one https://www.christian-schneider.net/...
3
votes
2answers
4k views

How can I have received this email?

I usually delete SPAM, but this email caught my attention: As you can see, in "To:" field there is spammer account, but I thought: it's not important, in message header there must be some hidden "for"...
1
vote
1answer
3k views

Damage of a leaked ETag

I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability. For example in the server response headers: ETag: X/"1234-56789" But I have not found ...