Can you help me understand the graphs? What is being plotted on the X axis?
I think popularity, from most to least?
How widely used are security-based HTTP response headers?
31–36 of 36 posts
Re: How widely used are security-based HTTP response headers?
#32Earlier quoted context omitted.
Server: header makes people gone mad?
It wastes space, and reveals unnecessary information about your server infrastructure.
As if turning it off helps. Nginx is so popular, attackers would just try Nginx-specific exploits right after trying Apache ones even if they don't know for sure whether you are running Nginx.
Re: How widely used are security-based HTTP response headers?
#33Re: How widely used are security-based HTTP response headers?
#34I'd really like to know if any of you have used the report feature. It seems like any report you got would show you a bug in your code. What were the bugs? How many reports did you get?
Re: How widely used are security-based HTTP response headers?
#35I'd really like to know if any of you have used the report feature. It seems like any report you got would show you a bug in your code. What were the bugs? How many reports did you get?
To be honest, most of the reports I get for my sites aren't legitimate issues. Malware on the endpoint makes changes to pages (like inserting ads) that generate reports, certain browser features trigger changes that cause reports. There are also browser plugins and addons that make changes which also cause reports to be sent. You can always create a report only CSP which will send reports but not block actions on the page and use my service at https://report-uri.io to gather the reports for you to look at them. All free and no risk of breaking anything, if you're interested.
Re: How widely used are security-based HTTP response headers?
#36For people using Node/Express, Helmet is a useful little library that lets you add these security headers and CSP pretty easily: https://github.com/helmetjs/helmet
Lusca[1] is the NPM module for use with Express that comes in the KrakenJS middleware (open sourced by PayPal).
app.use(lusca.csrf());
app.use(lusca.csp({ /* ... */}));
app.use(lusca.xframe('SAMEORIGIN'));
app.use(lusca.p3p('ABCDEF'));
app.use(lusca.hsts({ maxAge: 31536000 }));
app.use(lusca.xssProtection(true));