secure-headers

Configure HTTP security headers like Content Security Policy and X-Frame-Options in Express.js using Helmet.js to prevent XSS and clickjacking. The Skill provides direct implementation examples for setting these headers in your application.

Setting up Content Security Policy (CSP) and HSTS in Nginx involves adding specific directives to your server configuration to mitigate cross-site scripting and enforce HTTPS. This Skill provides cross-platform configuration examples for Nginx.

Configuring X-Frame-Options and MIME-sniffing headers for a new web app deployment is needed to minimize vulnerabilities against clickjacking and malicious file execution. This ensures critical HTTP security headers are implemented correctly during deployment.

This Skill provides HTTP security header examples for Apache, Nginx, and Express.js. It covers cross-platform implementations for setting up headers like Strict-Transport-Security (HSTS) across different web server environments.

Configuring HSTS matters for web security because it forces browsers to strictly use HTTPS, preventing protocol downgrade attacks. You should apply HSTS when deploying web applications to ensure all critical security headers are active.

Limitations of implementing Content Security Policy include potential blockage of legitimate inline scripts and external resources if directives are too strict. Careful tuning of CSP rules is required to balance security and application functionality.