missing-security-headers-anti-pattern

Missing security headers leave web applications vulnerable to browser-based attacks like cross-site scripting (XSS) and clickjacking. This anti-pattern occurs when HTTP responses lack crucial headers such as Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options, exposing users to security risks.

Add Content-Security-Policy and Strict-Transport-Security headers to your web application HTTP responses using secure code examples that define resource loading policies and enforce HTTPS connections. This Skill provides clear GOOD code examples demonstrating how to implement these protective headers correctly.

Detect missing security headers in your web application by reviewing HTTP responses through browser developer tools and security scanners. This Skill provides guidance on identifying the absence of headers like CSP, HSTS, and X-Frame-Options to ensure proper configuration against common attacks.

X-Frame-Options prevents clickjacking by controlling frame rendering, while Content-Security-Policy is needed to prevent XSS by restricting resource loading. Use this Skill when reviewing your web application security posture to ensure all necessary protective headers are configured correctly.

HTTP security headers mitigate browser-based attacks like XSS and clickjacking but do not replace secure server-side validation or input sanitization. They function as a defense-in-depth layer; comprehensive web application security requires addressing vulnerabilities beyond just configuring response headers.