HTTP Security Headers: Inspect and Understand a Response

Security headers instruct browsers how to handle particular aspects of a response. They complement application security rather than replacing authentication, authorization or input handling. A useful review checks both whether a header exists and whether its value makes sense for the application.

Inspect the actual document response

Open browser developer tools, select the Network panel, reload a page you control and inspect the main document response headers. Record redirects separately. A header on a CSS file does not establish that the HTML document receives the same policy. Some headers also have different effects depending on the response type.

# Inspect headers for a local development server
curl -I http://localhost:3000/

# Example values for discussion, not a universal deployment policy
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: frame-ancestors 'self'

Understand the policy you are measuring

nosniff directs the browser to respect declared content types in relevant contexts; it does not correct a wrong Content-Type value. Referrer-Policy controls information sent in the Referer header. A frame-ancestors policy constrains which origins may embed a page, but it is only one CSP directive and is not a complete script policy.

Treat HSTS as an HTTPS deployment decision

Strict-Transport-Security tells supporting browsers to use HTTPS for a host after receiving a valid policy over HTTPS. includeSubDomains extends its scope, so verify that relevant subdomains support HTTPS before enabling it. Preloading is a separate commitment and should not be added mechanically to satisfy a checklist.

Roll out CSP with application knowledge

An overly broad CSP may offer little protection, while an overly restrictive one can break scripts, styles, forms or integrations. Inventory required sources and consider report-only evaluation before enforcement. Inline scripts may need a nonce or hash strategy; copying an example policy without that context is unreliable.

Report gaps without overstating impact

A missing header is a configuration observation. Explain the protection it could provide and whether an equivalent control exists. Do not claim a demonstrated exploit merely because an automated scanner marks a header absent. Include the tested URL, response status and policy value so a maintainer can reproduce the result.

Practice and check your understanding

Inspect a local page and create a table with header, observed value, intended purpose and a test for breakage. Add one policy in development, then check page behavior and browser console messages before considering production.

Continue learning

Explore the related Code Hacker course syllabus for structured learning. Then read Validate Node.js API Input Before Running Business Logic to connect this exercise to the next skill.

Reference

OWASP Secure Headers Project provides the underlying API or technical guidance. Check the documentation for the version you use; examples here are small learning exercises rather than complete production implementations.