Security Header

Overview

Web security headers can restrict script sources, enforce encrypted transport, prevent framing, control referrer information, limit browser features, or influence content-type handling. Examples include Content-Security-Policy, Strict-Transport-Security, and Permissions-Policy.

Headers are context-dependent and misconfiguration can break legitimate functionality or create a false sense of protection. They do not repair vulnerable server logic, unsafe authentication, compromised dependencies, or data exposed outside the protected client behavior.

Teams should define headers from application threats, test them across supported clients, deploy restrictive policies gradually where needed, and monitor reports or compatibility. Values should be version-controlled and verified on every relevant response, including errors, redirects, and externally hosted content. Automated tests should detect missing or weakened headers before each production release.

A security header is protocol metadata that instructs clients or intermediaries to apply specific protections when handling requests, responses, or content. Security headers strengthen client-side enforcement, but correct scope, testing, deployment coverage, and secure application logic remain necessary.

A production treatment of Security Header should test protocol metadata that instructs clients or intermediaries to apply specific protections when handling requests, responses, or content within the relevant asset, decision, or service state. The Security Header context record for protocol metadata that instructs clients, responses, and content should preserve source data, configuration or policy version, responsible actor, exception, and outcome. Review of Security Header should determine whether safeguards addressing protocol metadata that instructs clients, responses, and content changed exposure in practice, not merely whether a document or setting existed.

Quality review for Security Header should sample real cases involving protocol metadata that instructs clients, responses, and content, compare expected and actual outcomes, and track unresolved exceptions until remediation is independently verified.