On this publish, we’re going to undergo the HTTP Security Headers and configurations it is best to use on your challenge so as to save your server. At first, we take into account that each one request and response are transmitted over HTTPS. And that each one the logging and data from the server configuration are hidden.
Introduction
Dozens of internet sites are hacked due to misconfiguration or an absence of safety. You possibly can certainly see on the OWASP Top 10, which are the High 10 recognized flaws on internet servers and companies from the OWASP (Open Internet Software Security Challenge), that Security Misconfiguration is essentially the most recognized reason behind vulnerabilities on internet companies.
That is generally a result of insecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP Security Headers, and verbose error messages containing delicate data. Not solely should all operating systems, frameworks, libraries, and functions are securely configured, however, they should be patched/upgraded in a well-timed trend.
Let’s deep drive into the weaknesses and impacts of it.
| Menace Brokers / Assault Vectors | Security Weak spot | Impacts |
|---|---|---|
| App-Particular/Exploitability:3 | Prevalence:3/Detectability:3 | Technical:2/Enterprise? |
| Attackers will usually try to exploit unpatched flaws or entry default accounts, unused pages, unprotected records data, and directories, and so on to acquire unauthorized entry or data of the system. | Security misconfiguration can occur at any degree of a software stack, together with the community companies, platform, internet server, software server, database, frameworks, custom code, and pre-installed digital machines, containers, or storage. Automated scanners are helpful for detecting misconfigurations, use of default accounts or configurations, pointless companies, legacy choices, and so on. | Such flaws continuously give attackers unauthorized entry to some system knowledge or performance. Sometimes, such flaws lead to an entire system compromise. The enterprise influence relies upon the safety wants of the applying and knowledge. |
Earlier than you begin:
- Do not forget to backup your present configuration earlier than making any change to your configuration.
- Furthermore, some headers might not be suitable for the browser. I encourage you to try the browser compatibility on the compatibility matrix that’s out there on that web page.
- Mod-Headers should be enabled in Apache to implement these headers. Guarantee the road is uncommented in
httpd.conffile.
Allow us to evaluate the HTTP headers checklist that we’re going to cowl:
- X-XSS-Safety
- X-Body-Choices
- X-Content material-Sort-Choices
- Content material-Security-Coverage
- Referrer-Coverage
- HTTP Strict Transport Security
- SameSite
- HttpOnly
- Safe
- Conclusion
- Annexes
Be aware: If you need to have the sum up and the Apache and Nginx configurations, you’ll be able to go to the “Conclusion”.
X-XSS-Safety
The X-XSS-Safety header can forestall some degree of XSS (CrosSite-Scripting) assaults. XSS assaults allow attackers to inject client-side scripts into internet pages considered by different customers. Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| 8 | . | NS | 4+ | . | . | . |
There are 4 doable methods you’ll be able to configure that header.
| Parameter Worth | Which means |
|---|---|
| 0 | XSS filter disabled |
| 1 | XSS filter enabled and sanitized the web page if an assault detected |
| 1;mode=block | XSS filter enabled and prevented rendering the web page if assault detected |
| 1;report=http://example.com/report_URI | XSS filter enabled and reported the violation if assault detected |
What we suggest to implement : 1;mode=block
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header set X-XSS-Safety "1; mode=block". Restart the apache to confirm |
| NGinx | Add the next in nginx.conf below HTTP block. add_header X-XSS-Safety "1; mode=block";. Nginx restart is required to get this mirrored on your internet web page response header. |
X-Body-Choices
The X-Body-Choices header prevents Clickjacking vulnerability on your website. By implementing this header, you instruct the browser not to embed your internet web page in body/iframe.
Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| 8 | 13 | 47 | 49 | 9.1 | 39 | 4.4 |
There are 3 doable methods you’ll be able to configure that header.
| Parameter Worth | Which means |
|---|---|
| SAMEORIGIN | Body/iFrame of content material is barely allowed from the identical website origin. |
| DENY | Stop any area to embed your content material utilizing body/iframe. |
| ALLOW-FROM | Enable framing the content material solely on a specific URI. |
What we suggest to implement : DENY
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header all the time append X-Body-Choices DENY. Restart the apache to confirm |
| NGinx | Add the next in nginx.conf below HTTP block. add_header X-Body-Choices “DENY”;. Nginx restart is required to get this mirrored on your internet web page response header. |
X-Content material-Sort-Choices
The X-Content material-Sort-Choices header prevents MIME varieties safety danger by including this header in your internet web page’s HTTP response. Having this header instruct browser to take into account records data varieties as outlined and disallow content material sniffing.
Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| 8 | . | 51 | 1.0 | NS | 13 | . |
There may be 1 doable approach you’ll be able to configure that header.
| Parameter Worth | Which means |
|---|---|
| nosniff | Think about records data varieties as outlined and disallow content material sniffing. |
What we suggest to implement : nosniff
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header set X-Content material-Sort-Choices nosniff. Restart the apache to get the configuration energetic after which confirm. |
| NGinx | Add the next in nginx.conf below server block. add_header X-Content material-Sort-Choices nosniff;. Nginx restart is required to get this mirrored on your internet web page response header. |
Content material Security Coverage
The Content material Security Coverage prevents XSS, clickjacking, code injection assaults by implementing the Content material Security Coverage (CSP) header in your internet web page HTTP response.
CSP instructs the browser to load allowed content material to load on the website.
However, for those who implement CSRF, in some frameworks (like AngularJS) the browser retrieves the CSRF cookie and provides a customized header XSRF-HEADER to the response so as to implement a CSRF prevention technique. So you could have to be very cautious about the way you implement that header. You could find a number of nice strategies to forestall CSRF on the OWASP website.
Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| 11 | 13 | 47 | 49 | 9.1 | 39 | 4.4 |
There are 23 doable methods you’ll be able to configure that header.
| Parameter Worth | Which means |
|---|---|
| base-uri | Outline the bottom URI for relative URI. |
| default-src | Outline loading coverage for all assets sort in case of a useful resource sort devoted directive shouldn’t be outlined (fallback). |
| script-src | Outline which scripts the protected useful resource can execute. |
| object-src | Outline from the place the protected useful resource can load plugins. |
| style-src | Outline which types (CSS) the person applies to the protected useful resource. |
| img-src | Outline from the place the protected useful resource can load photos. |
| media-src | Outline from the place the protected useful resource can load video and audio. |
| frame-src | Deprecated and changed by child-src. |
| child-src | Outline from the place the protected useful resource can embed frames. |
| frame-ancestors | Outline from the place the protected useful resource might be embedded in frames. |
| font-src | Outline from the place the protected useful resource can load fonts. |
| connect-src | Outline which URIs the protected useful resource can load utilizing script interfaces. |
| manifest-src | Outline from the place the protected useful resource can load manifest. |
| form-action | Outline which URIs can be utilized because of the motion of HTML-type parts. |
| sandbox | Specifies an HTML sandbox coverage that the person agent applies to the protected useful resource. |
| script-nonce | Outline script execution by requiring the presence of the required nonce on script parts. |
| plugin-types | Outline the set of plugins that may be invoked by the protected useful resource by limiting the forms of assets that may be embedded. |
| reflected-xss | Instructs a person agent to activate or deactivate any heuristics used to filter or block mirrored cross-site scripting assaults, equal to the consequences of the non-standard X-XSS-Safety header. |
| block-all-mixed-content | Stop person brokers from loading combined content material. |
| upgrade-insecure-requests | Instructs person agent to obtain insecure assets utilizing HTTPS. |
| referrer | Outline data person agent should ship in Referer header. |
| report-uri (deprecated) | Specifies a URI to which the person agent sends stories about coverage violations. |
| report-to | Specifies a bunch (outlined in Report-To header) to which the person agent sends stories about coverage violations. |
What we suggest to implement : default-src on self with reporting enabled
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header set Content material-Security-Coverage: default-src 'self'; report-uri http://reportcollector.instance.com/collector.cgi. Restart the apache to get the configuration energetic after which confirm. |
| NGinx | Add the next in nginx.conf below server block. add_header Content material-Security-Coverage "default-src 'self';", "report-uri http://reportcollector.instance.com/collector.cgi;"". Nginx restart is required to get this mirrored on your internet web page response header. |
Referrer-Coverage
The Referrer-Coverage HTTP header governs which referrer data, despatched within the Referer header, needs to be included with requests made.
Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| NS | NS | 50 | 56 | NS | 43 | . |
There are 8 doable methods you’ll be able to configure that header.
| Parameter Worth | Which means |
|---|---|
| no-referrer | The Referer header will likely be omitted completely. |
| no-referrer-when-downgrade | That is the person agent’s default conduct if no coverage is specified. |
| origin | Solely ship the origin of the doc because of the referrer in all circumstances. |
| origin-when-cross-origin | Ship a full URL when performing a same-origin request, however solely ship the origin of the doc for different circumstances. |
| same-origin | A referrer will likely be despatched for same-site origins, however, cross-origin requests will comprise no referrer data. |
| strict-origin | Solely ship the origin of the doc because the referrer to a previous as-much-secure vacation spot (HTTPS->HTTPS), however, do not ship it to a much less safe vacation spot (HTTPS->HTTP). |
| strict-origin-when-cross-origin | Ship a full URL when performing a same-origin request, solely ship the origin of the doc to prior as-much-secure vacation spot (HTTPS->HTTPS), and ship no header to a much less safe vacation spot (HTTPS->HTTP). |
| unsafe-url | Ship a full URL (stripped from parameters) when performing a same-origin or cross-origin request. |
What we suggest to implement : no-referrer
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header set Referrer-Coverage "no-referrer". Restart the apache to get the configuration energetic after which confirm. |
| NGinx | Add the next in nginx.conf below server block. add_header Referrer-Coverage no-referrer;. Nginx restart is required to get this mirrored on your internet web page response header. |
HTTP Strict Transport Security
HTTP Strict Transport Security (HSTS) is an internet safety coverage mechanism that helps to defend websites in opposition to protocol downgrade assaults and cookie hijacking. It permits Internet servers to declare that internet browsers (or different complying person brokers) ought to solely work together with it utilizing safe HTTPS connections, and by no means by way of the insecure HTTP protocol.
Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| 11 | 13 | 47 | 49 | 9.1 | 39 | 4.4 |
There are 2 doable methods you’ll be able to configure that header.
| Parameter Worth | Which means |
|---|---|
| max-age=SECONDS | The time, in seconds, that the browser ought to keep in mind that this website is barely to be accessed utilizing HTTPS. |
| includeSubDomains | If this optionally available parameter is specified, this rule applies to all the website’s subdomains as effectively. |
What we suggest to implement : max-age=31536000; includeSubDomains
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header set Strict-Transport-Security "max-age=31536000; includeSubDomains". Restart the apache to get the configuration energetic after which confirm. |
| NGinx | Add the next in nginx.conf below server block. add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains';. Nginx restart is required to get this mirrored on your internet web page response header. |
When receiving an HTTP request, a server can ship a Set-Cookie header with the response. The cookie is often saved by the browser, after which the cookie is shipped with requests made to the identical server inside a Cookie HTTP header. An expiration date or period might be specified, after which the cookie is now not despatched. Moreover, restrictions to a selected area and path might be set, limiting the place the cookie is shipped.
The Set-Cookie and Cookie headers: The Set-Cookie HTTP response header sends cookies from the server to the person agent. A easy cookie is ready like this Set-Cookie: <cookie-name>=<cookie-value>.
Session cookies: The cookie created above is a session cookie: it’s deleted when the shopper shuts down as a result of it did not specify an Expires or Max-Age directive. Nevertheless, internet browsers might use session restoring, which makes most session cookies everlasting, as if the browser was by no means closed.
Everlasting cookies: As a substitute for expiring when the shopper closes, everlasting cookies expire at a specific date (Expires) or after a selected size of time (Max-Age). Everlasting cookies are set like this Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2020 07:28:00 GMT;.
Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| . | . | . | . | . | . | . |
There are a lot of doable cookies you’ll be able to add to enhance the safety of your product.
“SameSite” Cookie: SameSite cookies let servers require {that a} cookie should not be despatched with cross-site requests, which considerably protects in opposition to cross-site request forgery assaults (CSRF). SameSite cookies are nonetheless experimental and never but supported by all browsers. The identical-site attribute can have one in all two values:
|Worth|Which means|
|—|—|
|strict|If a same-site cookie has this attribute, the browser will solely ship cookies if the request originated from the website that set the cookie. If the request originated from a unique URL than the URL of the present location, not one of the cookies tagged with the strict attribute will likely be included.|
|lax|If the attribute is ready to lax, same-site cookies are withheld on cross-domain subrequests, equivalent to calls to load photos or frames, however will likely be despatched when a person navigates to the URL from an exterior website, for instance, by following a hyperlink.|
The default conduct if the flag shouldn’t be set, or not supported by the browser, is to embody the cookies in any request, together with cross-origin requests.
“Safe” Cookie: A safe cookie is barely despatched to the server with an encrypted request over the HTTPS protocol. Even with Safe, delicate data ought to by no means be saved in cookies, as they’re inherently insecure and this flag cannot supply actual safety. Beginning with Chrome 52 and Firefox 52, insecure websites (HTTP:) cannot set cookies with the Safe directive.
“HttpOnly” Cookie: To forestall cross-site scripting (XSS) assaults, HttpOnly cookies are inaccessible to JavaScript’s Doc. cookie API; they’re solely despatched to the server. For instance, cookies that persist server-side periods do not want to be out there to JavaScript, and the HttpOnly the flag needs to be set.
What we suggest to implement : Safe=True; HttpOnly=True, SameSite=strict
Apache
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Safe;SameSite=Strict. Restart the apache to get the configuration energetic after which confirm. |
| Apache HTTP Server decrease than Apache 2.2.4 | Add the next entry in httpd.conf of your Apache webserver. Header set Set-Cookie HttpOnly;Safe;SameSite=Strict. Restart the apache to get the configuration energetic after which confirm. |
PHP
|
1 2 3 |
setcookie ( string $key [, string $value = "" [, int $expires = 0 [, string $path = "" [, string $domain = "" [, bool $secure = FALSE [, bool $httponly = FALSE ]]]]]] ) : bool |
Node.JS
|
1 2 3 |
response.setHeader('Set-Cookie', 'key=worth; safe; HttpOnly; SameSite=Strict'); |
Python
|
1 2 3 |
self.set_secure_cookie('key', worth, safe=True, httponly=True) |
Ruby on Rails
|
1 2 3 |
cookies["key"] = { :worth => "worth", :safe => true, :http_only => true, :same_site => } |
Then you’ll be able to check your web site’s HTTP response header in opposition to that website.
Conclusion
Let’s sum up the server configuration you’ll be able to use.
Apache
| Header | Implementation |
|---|---|
| X-XSS-Safety | Header set X-XSS-Safety “1; mode=block” |
| X-Body-Choices | Header set X-Body-Choices "DENY" |
| X-Content material-Sort-Choices | Header set X-Content material-Sort-Choices "nosniff" |
| Content material-Security-Coverage | Header set Content material-Security-Coverage: default-src 'self'; report-uri http://reportcollector.instance.com/collector.cgi |
| Referrer-Coverage | Header set Referrer-Coverage "no-referrer" |
| HTTP Strict Transport Security | Header all the time set Strict-Transport-Security "max-age=63072000; includeSubdomains" |
Nginx
| Header | Implementation |
|---|---|
| X-XSS-Safety | add_header X-XSS-Safety "1;mode=block"; |
| X-Body-Choices | add_header X-Body-Choices "DENY"; |
| X-Content material-Sort-Choices | add_header X-Content material-Sort-Choices "nosniff"; |
| Content material-Security-Coverage | add_header Content material-Security-Coverage "default-src 'self';", "report-uri http://reportcollector.instance.com/collector.cgi;" |
| Referrer-Coverage | add_header Referrer-Coverage no-referrer; |
| HTTP Strict Transport Security | add_header Strict-Transport-Security "max-age=63072000; includeSubdomains"; |
Cookies
| Server sort | How to |
|---|---|
| Apache HTTP Server | Add the next entry in httpd.conf of your Apache webserver. Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Safe;SameSite=Strict. Restart the apache to get the configuration energetic after which confirm. |
| Apache HTTP Server decrease than Aache 2.2.4 | Add the next entry in httpd.conf of your Apache webserver. Header set Set-Cookie HttpOnly;Safe;SameSite=Strict. Restart the apache to get the configuration energetic after which confirm. |
Browser Help
| Web Explorer | Edge | Firefox | Chrome | Safari | Opera | Android |
|---|---|---|---|---|---|---|
| HTTP Strict Transport Security (HSTS) | 11 | 13 | 47 | 49 | 9.1 | 39 |
| Public Key Pinning Extension for HTTP (HPKP) | NS | NS | 47 | 49 | NS | 39 |
| X-Body-Choices | 8 | 13 | 47 | 49 | 9.1 | 39 |
| X-XSS-Safety | 8 | . | NS | 4+ | . | . |
| X-Content material-Sort-Choices | 8 | . | 51 | 1.0 | NS | 13 |
| Content material-Security-Coverage | 11 | 13 | 47 | 49 | 9.1 | 39 |
| X-Permitted-Cross-Area-Insurance policies | . | . | . | . | . | . |
| Referrer-Coverage | NS | NS | 50 | 56 | NS | 43 |
| Count on-CT | . | . | . | 61 | . | 48 |
| Characteristic-Coverage | . | . | . | . | . | . |
How to Take a look at in Actual Life
That is the best approach to check safety headers. Simply open up a console and fireplace Curl; Curl will seize the headers for you inside seconds. We want to use Curl with parameters I and L. I swap will inform curl to seize the pinnacle and the L parameter will assist to comply with the redirects if our goal has any.
|
1 2 3 |
curl <span class="nt">-I</span> <span class="nt">-L</span> <span class="nt">--url</span> <goal area or IP> |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
➜ curl <span class="nt">-I</span> <span class="nt">-L</span> <span class="nt">--url</span> instance.fr/espace-client HTTP/1.1 301 Moved Completely Location: https://www.instance.fr/ Content material-Size: 0 Connection: shut Date: Thu, 04 Jul 2019 13:18:30 GMT HTTP/2 200 content-type: textual content/html<span class="p">;</span> <span class="nv">charset</span><span class="o">=</span>UTF-8 x-frame-options: SAMEORIGIN strict-transport-security: max-age<span class="o">=</span>15724800<span class="p">;</span> includeSubDomains cache-control: max-age<span class="o">=</span>3600, public <span class="nb">hyperlink</span>: <http://www.instance.fr/><span class="p">;</span> <span class="nv">rel</span><span class="o">=</span><span class="s2">"shortlink"</span>, <http://www.instance.fr/><span class="p">;</span> <span class="nv">rel</span><span class="o">=</span><span class="s2">"canonical"</span> <span class="nb">hyperlink</span>: </node/1><span class="p">;</span> <span class="nv">rel</span><span class="o">=</span><span class="s2">"revision"</span> x-ua-compatible: <span class="nv">IE</span><span class="o">=</span>edge content-language: fr x-content-type-options: nosniff x-frame-options: DENY expires: Solar, 19 Nov 1978 05:00:00 GMT last-modified: Thu, 04 Jul 2019 12:29:39 GMT etag: W/<span class="s2">"1562243379"</span> x-drupal-cache: HIT x-xss-protection: 1<span class="p">;</span> <span class="nv">mode</span><span class="o">=</span>block access-control-allow-origin: <span class="k">*</span> content-security-policy: upgrade-insecure-requests access-control-allow-methods: POST, GET, DELETE, PUT access-control-max-age: 1000 access-control-allow-headers: Content material-Sort, origin, settle for referrer-policy: no-referrer <span class="nb">date</span>: Thu, 04 Jul 2019 13:18:30 GMT differ: cookie |
Nmap can be utilized to check and validate safety headers very simply. We are able to leverage a Nmap script named “HTTP-security-headers”. Obtain it from this hyperlink: https://svn.nmap.org/nmap/scripts/http-security-headers.nse
|
1 2 3 |
nmap <span class="nt">-p</span> 443,80 <span class="nt">--script</span> http-security-headers <goal IP or Area> |
Refer to the beneath outcome: It provides a pleasant overview of carried-out header values.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 |
➜ nmap <span class="nt">-p</span> 443,80 <span class="nt">--script</span> http-security-headers instance.fr Beginning Nmap 7.70 <span class="o">(</span> https://nmap.org <span class="o">)</span> at 2019-07-04 15:19 CEST Nmap scan report <span class="k">for </span>instance.fr <span class="o">(</span>92.223.124.199<span class="o">)</span> Host is up <span class="o">(</span>0.012s latency<span class="o">)</span><span class="nb">.</span> PORT STATE SERVICE 80/tcp open http | http-security-headers: | Strict_Transport_Security: | Header: Strict-Transport-Security: max-age<span class="o">=</span>15724800<span class="p">;</span> includeSubDomains | X_Frame_Options: | Header: X-Body-Choices: SAMEORIGIN, DENY | Description: The browser should not show this content material <span class="k">in </span>any body. | X_XSS_Protection: | Header: X-XSS-Safety: 1<span class="p">;</span> <span class="nv">mode</span><span class="o">=</span>block | Description: The browser will forestall the rendering of the web page when XSS is detected. | X_Content_Type_Options: | Header: X-Content material-Sort-Choices: nosniff | Description: Will forestall the browser from MIME-sniffing a response away from the declared content-type. | Content_Security_Policy: | Header: Content material-Security-Coverage: upgrade-insecure-requests | Description: Instructs person agent to obtain insecure assets utilizing HTTPS. | Cache_Control: | Header: Cache-Management: max-age<span class="o">=</span>3600, public | Expires: |_ Header: Expires: Solar, 19 Nov 1978 05:00:00 GMT 443/tcp open https | http-security-headers: | Strict_Transport_Security: | Header: Strict-Transport-Security: max-age<span class="o">=</span>15724800<span class="p">;</span> includeSubDomains | X_Frame_Options: | Header: X-Body-Choices: SAMEORIGIN, DENY | Description: The browser should not show this content material <span class="k">in </span>any body. | X_XSS_Protection: | Header: X-XSS-Safety: 1<span class="p">;</span> <span class="nv">mode</span><span class="o">=</span>block | Description: The browser will forestall the rendering of the web page when XSS is detected. | X_Content_Type_Options: | Header: X-Content material-Sort-Choices: nosniff | Description: Will forestall the browser from MIME-sniffing a response away from the declared content-type. | Content_Security_Policy: | Header: Content material-Security-Coverage: upgrade-insecure-requests | Description: Instructs person agent to obtain insecure assets utilizing HTTPS. | Cache_Control: | Header: Cache-Management: max-age<span class="o">=</span>3600, public | Expires: |_ Header: Expires: Solar, 19 Nov 1978 05:00:00 GMT Nmap <span class="k">achieved</span>: 1 IP tackle <span class="o">(</span>1 host up<span class="o">)</span> scanned <span class="k">in </span>0.88 seconds |
HTTP Security Headers
The article was published on August 4, 2021 @ 3:14 PM
Leave a Comment