The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [header]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
150
votes
4answers
22k views

Which security measures make sense for a static web site?

I have a static web site. Users cannot log in or perform any other actions. Which of the common HTTP security measures make sense for my site? Do I need any of these? HTTPS Strict transport security ...
24
votes
1answer
2k views

HTTP HEAD and its security versus operational uses

Most security advice I see recommends turning off HTTP Methods like TRACE, OPTIONS, HEAD etc. So now I have turned off most of these options on my web server and leaving only GET and POST options that ...
20
votes
2answers
4k views

What are the negative aspects of creating fake security footprints?

My take on reducing the risk of being hacked on products and installation have often been to create false footprints. From my own experience, the servers I've spent most time (and hate) on hacking ...
16
votes
2answers
4k views

How did this email list a fake recipient? [duplicate]

My friend recently received a suspicious email for an iTunes gift card purchase from "Apple Store" with a header that displayed a fake "To:" address for orders@apple-store.com. Unsurprisingly, this ...
12
votes
1answer
9k views

Security Headers for a web API

I just got a setup, a golang web api behind a caddy server that has HTTPS by default via Let's Encrypt, the server proxies all requests to the web api. So I went around to test my webserver "security" ...
12
votes
1answer
7k views

Why does Chrome send four browsers in the user-agent header?

I am using Chrome in linux with Version 51.0.2704.63 (64-bit). I recorded a HTTP request of Chrome and here is part of the recording: User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (...
11
votes
1answer
6k views

Vary: origin response header and CORS exploitation

Recently PortSwigger (guys behind Burp Suite) came up with a blog post discussing the security risks associated with CORS mis-configurations. http://blog.portswigger.net/2016/10/exploiting-cors-...
9
votes
2answers
1k views

Best practices when forwarding an email or copy / pasting from confidential information sources?

I get asked this a lot from older people, or for legal matters. They want to forward an email message they've received to another party, while removing any identifying information from the first party ...
8
votes
2answers
2k views

How does sending referrer HTTP headers protect against CSRF attacks?

How does sending referrer HTTP headers protect against CSRF attacks? I tried logging into an HTTPS site with Firefox's network.http.sendRefererHeader set to 0 (i.e., completely disabled, as a measure ...
7
votes
1answer
993 views

How can I determine (as a layman) if an E-mail was set to self destruct?

I tried to access an old E-mail to print for a court case only to find there is no content. I checked on all my devices and outlook account. The E-mail in question is from a gmail user and I have ...
7
votes
1answer
3k views

iOS Mail App Security

I have my own domain name and I had some issues with the delivery time. So, I started looking at the mail header to see where my mail was stuck and why. That is not the issue.. While messing around ...
7
votes
1answer
285 views

How does X-XSS-Protection: “0” affect the security of my website?

How does disabling XSS protection affect my website? What security vulnerabilities does it open? My site requires the header to be used on certain pages, so what can I do to secure the pages with the ...
6
votes
3answers
8k views

Does the X-Permitted-Cross-Domain-Policies header have any benefit for my website if I'm not using Adobe products?

OWASP says the X-Permitted-Cross-Domain-Policies security header gives web clients "permission to handle data across domains". It specifically states that Adobe's Flash Player and Acrobat PDF Reader ...
6
votes
2answers
3k views

For which content types is it recommended to set X-XSS-Protection header?

One may probably suggest setting this header for all responses from a web server (I am thinking of value="1; mode=block"). However, does it make sense to set it when serving, say, images? CSS files? ...
5
votes
1answer
2k views

Content-type validation in REST APIs

I'm trying to wrap my head around, why it is advised to validate the content-type, sent by a client to a REST API. OWASP states in their REST Security Cheat Sheet: When POSTing or PUTting new data,...
5
votes
1answer
166 views

Is it worth verifying the request hostname in API-to-API communications?

When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an ...
4
votes
2answers
8k views

Is the Origin header really useful for securing a WebSocket?

I've been reading some posts about WebSockets security, and a few of them mention to use the Origin header for helping secure the connection. For example this one https://www.christian-schneider.net/...
4
votes
1answer
896 views

HTTP authentication - the HTTP header name is Authorization - why?

Why by HTTP authentication the HTTP header which contains credentials is called "Authorization"? Any historical explanation? I am asking because I realized that some people mix authentication with ...
3
votes
2answers
1k views

Can I trust the Host header received in the request?

The question is very simple: can I trust the value of the Host header? We are developing an application that serves some resources via HTTP and we wan't to have some private services and some others ...
3
votes
1answer
964 views

X-Frame-Options Absent but cant load the page in iframe

I am trying to find the reason that a certain webpage is not getting iframed even when X-Frame-Options header is absent. Observation: When I write an HTML with iframe tag pointing to the URL and save ...
3
votes
1answer
3k views

Are requests with no UserAgent header a risk?

A service I use has decided to block HTTP requests that do not provide a UserAgent, citing security reasons. As far as I can tell, the UserAgent is a string without a standard format used primarily ...
3
votes
1answer
3k views

How can the Origin header be used for CSRF prevention if Firefox doesn't send it for same origin requests or requests from data URIs?

I'm planning to use synchronizer tokens for CSRF prevention, but OWASP recommends checking the referrer and origin headers too. I've been trying to figure out the correct logic for this, but my ...
3
votes
1answer
555 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
3
votes
1answer
1k views

Is host header injection possible without cache or password reset?

I am a beginner in security and reading about host header injection. I tested an application for this vulnerability and it is possible there for some request, but the developer implemented no-cache, ...
3
votes
1answer
801 views

X-Content-Type-Options without content-type

X-Content-Type-Options helps to protect against attacks that take advantage of the browser trying to interpret HTTP responses with an incorrectly stated Content-Type. But what happens when the HTTP ...
3
votes
2answers
4k views

How can I have received this email?

I usually delete SPAM, but this email caught my attention: As you can see, in "To:" field there is spammer account, but I thought: it's not important, in message header there must be some hidden "for"...
2
votes
2answers
270 views

Content Security Policy Header not stopping attack

I created a simple test web application to test the use of the content security policy header. I included a vulnerability in my test app, such that submitting a basic XSS payload with script tags ...
2
votes
3answers
2k views

TLS to secure Basic HTTP Auth

Basic Auth, including Bearer tokens, depend on using TLS to prevent eavesdroppers from getting at your sensitive credentials or tokens. But I think there is an Elephant in the room that nobody talks ...
2
votes
1answer
536 views

Unsecure to allow all headers? [closed]

I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use? Header unset Connection Header unset Time-Zone Header unset Keep-Alive ...
2
votes
2answers
2k views

Can you trace someone through picture header information?

I learned that jpg, png, bmp and most image files contain headers and plain text in them. I decided to open a jpg file in Notepad and saw a bunch of information and I was wondering if there was a way ...
2
votes
3answers
3k views

What does the POST data of HackBar (Firefox add-on) do?

What does the POST DATA Feature of Hackbar (Addon of Firefox )do ? If I am checking for XML XXE vulnerability i use it .But what does it do by POSTing some data ? If I want to repeat the same thing ...
2
votes
1answer
946 views

Bypassing x-frame options possibility discussion

This has something to do with a different post I made: Other post While researching this a bit further I found the following blogpost: blog elev As I understand it this guy reads all content of a ...
2
votes
1answer
42 views

Why we should not allow our pages to be loaded through Iframe by unknown hosts?

One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin. One reason is because of phishing attacks, ok I understand. But if I ...
2
votes
1answer
129 views

Should HTTP Security headers be configured for all servers?

I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers (and other internet facing servers such as loadbalancers)....
2
votes
1answer
766 views

Web-Application with CORS Origin: * using authorization header

As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote: When responding to a credentialed request, the server must specify an ...
2
votes
1answer
251 views

When implementing CORS, should I check for a correct HOST header in my webapp?

I have a backend web server that serves an API (over HTTPS) to a frontend browser client on a different subdomain. It uses CORS to allow this. The CORS spec directs you to not send the CORS headers ...
2
votes
1answer
2k views

Setting the HTTP header X-Frame-Options DENY for static assets

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files? I guess ...
2
votes
1answer
963 views

CSP: What is script-src-attr and script-src-elem?

script-src-attr and script-src-elem directives are new additions in CSP3. I am not able to understand how are they different from the script-src directive. https://w3c.github.io/webappsec-csp/#...
2
votes
0answers
670 views

HTTP header: Range: bytes=XXX and possible XSS?

I'm currently experimenting with the "Range: bytes=XXX" HTTP header. Regardless the possibility of using it for the so called "Apache Killer" DoS attack (unpatched Apache version, etc), is it possible ...
1
vote
1answer
3k views

Damage of a leaked ETag

I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability. For example in the server response headers: ETag: X/"1234-56789" But I have not found ...
1
vote
2answers
125 views

How to prevent emails where sender has been spoofed? [closed]

I have been at the receiving end of some classic spoofed emails where the sender sends an email looking like it has come from a senior executive of the company. Of course, these are always asking for ...
1
vote
2answers
203 views

How to extract intresting data from malicious e-mail header

Premise: I know pretty well how SMTP works, and how to read an e-mail header. I know what all the main fieds mean, but I couldn't know what to look for if I want to know if the mail is kind of ...
1
vote
2answers
691 views

How do web browsers detect XSS attempts when the X-XSS-Protection header is enabled?

Simple question but hard to understand how web browsers make the distinction between legitimate and malicious code when mode=block is enabled? Of course, I would like to know how each rendering ...
1
vote
1answer
66 views

Is using default-src * safe?

I have a website to do security testing. The CSP is as follows. default-src * ; style-src 'self' 'unsafe-inline' data: https://netdna.bootstrapcdn.com/ http://s3.amazonaws.com/ https://s3.amazonaws....
1
vote
1answer
551 views

Proxy not rejecting illegal host header when coming from my VM provider's network

I have a django app hosted on a linode VM, proxied by nginx on that same VM. In my nginx config I have a block to deny bad host header requests: ## Deny illegal Host headers if ($host !~* ^(mydomain....
1
vote
1answer
145 views

What should content-type be of encoded page?

A security review replied that we have an incorrect content-type. There was no content-type stated so it defaulted to text/html. However the page was just encoded - Fiddler gives the option to ...
1
vote
1answer
1k views

Hiding HOST Header from HTTP Request

I would like to visit a site which supports HTTPS but to allow as few third-parties as possible to know which site I am visiting, excluding onion sites, through the HTTP Host Header. As I currently ...
1
vote
2answers
647 views

How secure is keeping a token in angular for future requests to a Laravel API?

I have an Angular JS Front end which consumes Web Services from an API developed using Laravel 5. BACKGROUND INFORMATION 1 When the user logs in, if it's successful the API returns a token and the ...
1
vote
1answer
317 views

SOAP Web Service: Basic Auth. vs Password in xml

I am testing a SOAP web service and the service sends username and password in every request as part of the XML body over SSL. I wanted to object to that and offer Basic Auth. but could not find any ...
1
vote
1answer
268 views

Is there an any risk with HTTP header value reflection?

This website has a header in the request (If-None-Match) and whatever you set the value to for it, the response will contain a header (ETag) with the value of the If-None-Match header. I understand ...