Summary

The system must attach properly-configured HTTP security headers to its requests and responses.

Description

HTTP security headers can be used to increase the overall security of an application. They are very effective at preventing the exploitation of several common vulnerabilities. For this reason, they should be configured as strictly as possible and included in all server requests and responses.

References

• CAPEC-19. Embedding scripts within scripts
• CAPEC-31. Accessing/Intercepting/Modifying HTTP cookies
• CAPEC-32. XSS through HTTP query strings
• CAPEC-161. Infrastructure manipulation
• CAPEC-173. Action spoofing
• CWE-116. Improper encoding or escaping of output
• CWE-525. Use of web browser cache containing sensitive information
• CWE-644. Improper neutralization of HTTP headers for scripting syntax
• CWE-1021. Improper restriction of rendered UI layers or frames
• OWASP10-A2. Cryptographic failures
• OWASP10-A3. Injection
• OWASP10-A4. Insecure design
• OWASP10-A5. Security misconfiguration
• MITRE-M1021. Restrict web-based content
• PADSS-5_2_7. Cross-site scripting (XSS)
• PADSS-5_2_9. Cross-site request forgery (CSRF)
• SANS25-9. Cross-site request forgery (CSRF)
• WASSEC-1_1. Transport support
• WASSEC-6_1_6. HTTP headers
• WASSEC-6_2_3_6. Client-side attacks - Flash-related attack
• WASC-A_09. Cross-site request forgery
• ISSAF-T_10_1. Web application assessment – Attack on secure HTTP
• MVSP-2_2. Application design controls - HTTPS only
• MVSP-2_3. Application design controls - Security Headers
• OWASPSCP-4. Session management
• ASVS-8_3_1. Sensitive private data
• ASVS-13_1_5. Generic web service security
• ASVS-14_4_1. HTTP security headers
• ASVS-14_4_4. HTTP security headers
• ASVS-14_4_6. HTTP security headers
• ASVS-1_12_2. Secure File Upload Architecture
• ASVS-12_3_4. File execution
• ASVS-13_2_5. RESTful web service
• ASVS-14_4_2. HTTP security headers
• ASVS-14_4_3. HTTP security headers
• ASVS-14_4_5. HTTP security headers
• ASVS-14_4_7. HTTP security headers
• ASVS-14_5_1. HTTP request header validation
• CASA-8_3_1. Sensitive Private Data
• CWE25-352. Cross-site request forgery (CSRF)

Weaknesses

• 043. Insecure or unset HTTP headers - Content-Security-Policy
• 071. Insecure or unset HTTP headers - Referrer-Policy
• 131. Insecure or unset HTTP headers - Strict Transport Security
• 132. Insecure or unset HTTP headers - X-Content-Type-Options
• 134. Insecure or unset HTTP headers - CORS
• 135. Insecure or unset HTTP headers - X-XSS Protection
• 136. Insecure or unset HTTP headers - Cache Control
• 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
• 152. Insecure or unset HTTP headers - X-Frame Options
• 153. Insecure or unset HTTP headers - Accept
• 329. Insecure or unset HTTP headers - Content-Type
• 440. Insecure or unset HTTP headers - Permissions-Policy