Simple ways to improve the security of a web app

Re:Simple ways to improve the security of a web app by mike-cardwell on Thursday December 08, 2011 @04:25AM (#3328408)

Your Strict-Transport-Security definition is missing the "includeSubDomains" flag. STS is a lot more effective if you use that flag.

You should discuss how X-Frame-Options prevents sites legitimately loading your pages inside frames too. I believe Reddit does this amongst others in order to displays a small control panel at the top of the page. X-Frame-Options is appropriate for many sites, but perhaps not for blogs.

You should talk about how CSP prevents most bookmarklets from working. For example readability and instapaper. I really like CSP, but people should be made aware of this.

[ Parent | on HN ]

Re:Simple ways to improve the security of a web app by mdirolf on Thursday December 08, 2011 @10:37AM (#3329469)

Yeah, I decided not to get into all of the options of each header. Partially because I was writing from a plane without wifi and partially because the response I was hoping for was "these things exist - I'll go read the docs on them".

That said, your points about X-Frame-Options and CSP are definitely important for usability. Maybe I'll update the post w/ some of those details.

[ Parent | on HN ]