Introduction to Browser Security Headers
Browser security headers provide a means for websites to describe how they should behave when loaded into the client. By specifying expected and allowable behaviors, security headers can thwart a number of otherwise serious attacks against websites.
What you'll learn
Security is all about defense in depth: applying layer upon layer of security controls such that any one single failure does not lead to a compromise of the application. One of those layers is the browser itself, which is becoming increasingly intelligent when it comes to implementing defenses. Security headers are a way of telling the browser how a website may behave when it’s loaded into the client. They provide numerous defenses against a variety of attacks in ways that have not previously been possible with security controls that ran solely on the server. In this course, we’ll walk through a number of essential security headers that provide even greater levels of defense for web applications. We’ll look at how they’re intended to work, what attacks they protect against, and how you can easily implement them in your website.
Table of contents
- Overview 2m
- Understanding the Problem that CSP Solves 8m
- Understanding CSP 4m
- Declaring Content Sources 4m
- Content Source Policy Directives 9m
- The Unsafe Inline and Unsafe Eval Keywords 9m
- Using Hashes and Nonces to Whitelist Unsafe Inline Content 7m
- The frame-ancestors 5m
- The report-uri Directive 3m
- Reporting Only 3m
- Browser Compatibility 3m
- Summary 2m
About the author
Troy Hunt is a Microsoft Regional Director and MVP for Developer Security, an ASPInsider, and a full time Author for Pluralsight—a leader in online training for technology and creative professionals. Troy has been building software for browsers since the very early days of the web and possesses an exceptional ability to distill complex subjects into relatable explanations. This has led Troy to become an industry thought leader in the security space and produce more than twenty top-rated courses ... more