HTTP headers

wikipedia:HTTP headers

• WWW-Authenticate
• Authorization:
• Content-Security-Policy
• X-Frame-Options (deprecated): https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

• strict-Transport-Security
• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• Cache-Control: no-cache, no-store, max-age

Activities

• Use Terraform aws lb: drop_invalid_header_fields to drop headers

Related terms

• aws s3 cp --cache-control
• Clickjacking
• Bearer token: Authorization: Bearer .../...
• curl --header
• Python, urllib library
• HTTP Security headers
• has been blocked by CORS policy no 'access-control-allow-origin' header is present on the request

Activities

• Read about Amazon CloudFront: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-add-security-headers.html
• Cloudflare: https://developers.cloudflare.com/pages/how-to/add-custom-http-headers/

See also

• HTTP headers, Security headers, HTTP Security headers, X-Forwarded-For (XFF)
• HTTP Headers: Authorization:, X-Frame-Options, Content-Security-Policy, Cache-Control, Terraform: drop_invalid_header_fields

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy