2 ms·
My modern frontend experience is pretty limited, but AFAICT there is no "this year's recommended header list." Rather, these issues are presented to developers
by csense 10y ago
My modern frontend experience is pretty limited, but AFAICT there is no "this year's recommended header list." Rather, these issues are presented to developers as a bunch of independent problems, each one of which you have to individually hear about, research and understand in depth before you can figure out what you actually need to do to make your application secure.
If the website works from a user perspective, and it's not being actively attacked in a way that leaves obvious signs in normal operations monitoring, then a lot of IT orgs simply won't have the mandate or the budget to go Googling to find out the very latest recommended HTTP headers.
- icebraining 10y agoBut to create this header, someone would have to compile that list, so that browsers could know how they should interpret it. So you can just publish it and allow developers to receive updates. By the way, there are already such lists and tools: https://www.owasp.org/index.php/OWASP_Secure_Headers_Project https://www.owasp.org/index.php/OWASP_Secure_Headers_Project (OWASP in general, though I hear the crypto stuff is weak) https://securityheaders.io/ https://securityheaders.io/