Web Application Security Fundamentals #10: Security Headers & HTTP Response Hardening

Security headers memberitahu browser bagaimana handle konten. Tanpa headers, browser akan menggunakan default (sering permissive untuk backwards compatibility). Security headers memperkuat defense.

Essential Security Headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
  → Force HTTPS, prevent downgrade attacks

Content-Security-Policy: default-src 'self'; script-src 'self' trusted.cdn.com
  → Whitelist resource origins, prevent inline script execution (XSS mitigation)

X-Content-Type-Options: nosniff
  → Prevent MIME sniffing (browser must respect Content-Type)

X-Frame-Options: DENY
  → Prevent clickjacking (don't allow frameing dalam iframe)

Referrer-Policy: strict-origin-when-cross-origin
  → Control referer information leakage

Permissions-Policy: camera=(), microphone=(), geolocation=()
  → Disable unnecessary browser features

Cache-Control: no-store, no-cache, must-revalidate
  → Prevent sensitive data caching di browser/proxy

Implementing in Code

Express.js

const helmet = require('helmet');

app.use(helmet());
// ↑ Sets default secure headers automatically

// Custom overrides:
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "trusted-cdn.com"],
    styleSrc: ["'self'", "'unsafe-inline'"],  // Avoid unsafe-inline
    imgSrc: ["'self'", "data:", "https:"],
    fontSrc: ["'self'", "fonts.googleapis.com"]
  }
}));

app.use(helmet.hsts({
  maxAge: 31536000,
  includeSubDomains: true,
  preload: true
}));

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;

Testing Headers

# Check headers
curl -I https://api.example.com

# Automated tool
https://securityheaders.com

# Should see all headers, no warnings

CSP (Content Security Policy) Deep-Dive

Purpose: Prevent XSS by restricting script execution sources.

# Restrictive (recommended)
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' fonts.googleapis.com

# Permissive (dangerous)
Content-Security-Policy: default-src *; script-src * 'unsafe-inline'
  ↑ This defeats the purpose

Testing CSP violations:

// Inline script blocked by CSP
<script>
console.log('This violates CSP if script-src doesn\'t allow inline');
</script>

// External script from trusted source allowed
<script src="https://trusted-cdn.com/lib.js"></script>

// Inline style blocked if style-src restrictive
<div style="color: red;">Blocked if style-src doesn't allow inline</div>

Common Mistakes

❌ CSP header present tapi mode is "report-only"
Report-only doesn't block violations, only logs them.

# ❌ Not enforcing
Content-Security-Policy-Report-Only: ...

# ✅ Enforcing
Content-Security-Policy: ...

❌ Using unsafe-inline sebagai workaround

# ❌ Defeats CSP purpose
script-src 'unsafe-inline'

# ✅ Use nonce atau hash
script-src 'nonce-randomvalue'

Checklist

• [ ] HSTS set
• [ ] CSP set (not report-only)
• [ ] X-Frame-Options = DENY atau SAMEORIGIN
• [ ] X-Content-Type-Options = nosniff
• [ ] Referrer-Policy set
• [ ] Cache-Control appropriate (no-store untuk sensitive)
• [ ] No unnecessary Permissions-Policy access
• [ ] No wildcard in CSP directives
• [ ] No unsafe-inline/unsafe-eval di CSP

Kesimpulan

Security headers = free defense layer yang implementasinya trivial tapi impactful. Set & forget.

Modul berikutnya (#11) membahas Testing Tools (Burp Suite, OWASP ZAP).

Next: #11 - Web Security Testing Tools