Problem
Browsers execute untrusted content by default. Missing headers enable XSS, clickjacking, mixed content, referrer leakage.
security-complianceestablished · low operational burden
Security Headers
Also known as: http-security-headers, csp, hsts, x-frame-options
Intent
Harden HTTP responses with security headers to mitigate XSS, clickjacking, MIME sniffing, and other client-side attacks.
Forces
- •Defense in depth: headers complement app-level security
- •Low effort, high impact: few lines of config
- •Must not break legitimate functionality
- •CSP is complex: inline scripts, third-party domains
Solution
✓ When to Use
- •All public-facing web applications
- •API endpoints serving HTML/JS
- •Compliance: PCI DSS, HIPAA, SOC2
✗ When Not to Use
- •Internal APIs (no browser)
- •Legacy apps with inline scripts everywhere (CSP hard)
- •Team not ready for CSP tuning
Pros
- +High impact, low effort
- +Defense in depth: mitigates whole classes of attacks
- +Compliance checkbox
Cons
- −CSP tuning: iterative, breaks things
- −Third-party scripts: need nonces/hashes
- −Report-only noise: high volume
- −Preload list: hard to remove
Cost Profile
Infrastructure
None — headers
Operational
Low — CSP tuning, monitoring
Cognitive
Medium — CSP directives, nonce flow
Failure Modes
CSP blocks legitimate script → broken UI
HSTS preload → can't revert HTTPS
COOP/COEP breaks cross-origin iframes
Referrer-Policy breaks analytics attribution
Nonce reuse → CSP bypass
Real-World Examples
Alternatives
- waf
- csp-only
- helmet-middleware
Related Patterns
- csp
- hsts
- xss-prevention
- clickjacking
- referrer-policy
Competency Domains
security compliancedistribution communicationreliability opsdeployment