HTTP headers

wikipedia:HTTP headers

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

• WWW-Authenticate
• Authorization:
• Content-Security-Policy
• X-Frame-Options (deprecated): https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

• strict-Transport-Security
• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• Cache-Control: no-cache, no-store, max-age
• X-Forwarded-For (XFF)
• Sec-Fetch-Mode
• if-none-match

Activities

• Use Terraform aws lb: drop_invalid_header_fields to drop not valid headers

Related terms

• aws s3 cp --cache-control
• Clickjacking
• Bearer token: Authorization: Bearer .../...
• curl --header
• Python, urllib library
• HTTP Security headers
• has been blocked by CORS policy no 'access-control-allow-origin' header is present on the request
• Request Header Fields: https://www.rfc-editor.org/rfc/rfc2616#section-5.3

Activities

• Read about Amazon CloudFront: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-add-security-headers.html
• Cloudflare: https://developers.cloudflare.com/pages/how-to/add-custom-http-headers/

See also

• X-Forwarded-For (XFF), HTTP/1.1: Request Header Fields
• HTTP headers, Security headers, HTTP Security headers, X-Forwarded-For (XFF), if-none-match
• HTTP Headers: Authorization:, X-Frame-Options, Content-Security-Policy, Cache-Control, Terraform: drop_invalid_header_fields

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy