Mozilla had an excellent resource [0] for security headers, especially Content Security Policy with examples for different use cases (e.g. APIs). See also Goog

Mozilla had an excellent resource [0] for security headers, especially Content Security Policy with examples for different use cases (e.g. APIs). See also Google's CSP Evaluator [1] and a blog post outlining security best practices [2]. It's surprisingly easy to make insecure policy that on the surface looks good, usually due to JSON-P endpoints on foreign endpoints. [0]: https://wiki.mozilla.org/Security/Guidelines/Web_Security#Content_Security_Policy https://wiki.mozilla.org/Security/Guidelines/Web_Security#Co... [1]: https://csp-evaluator.withgoogle.com/ https://csp-evaluator.withgoogle.com/ [2]: https://security.googleblog.com/2016/09/reshaping-web-defenses-with-strict.html?m=1 https://security.googleblog.com/2016/09/reshaping-web-defens...