Security response headers beyond CSP

What it is

The OWASP cheat sheet lists response headers that instruct browsers to behave conservatively: X-Content-Type-Options: nosniff (do not guess content types), Referrer-Policy (limit what URL is leaked in the Referer header), Permissions-Policy (disable features like camera or geolocation), Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy (isolate the browsing context), Strict-Transport-Security (HTTPS only) and X-Frame-Options or CSP frame-ancestors (clickjacking). Some older headers (X-XSS-Protection) are obsolete and should be omitted.

Why it matters

Each header removes a class of attack or leak at low cost. Their absence is the most common finding of automated scanners and reflects on the operator's diligence.

How to apply

• Set the headers once in middleware or the reverse proxy, for every response including errors.
• Choose Referrer-Policy: strict-origin-when-cross-origin (or stricter) as a default.
• Write Permissions-Policy with an explicit empty allowlist for features the site does not use.
• Enable HSTS only after every subdomain serves HTTPS; start with a short max-age.
• Verify with an external scan and with curl -I after each deployment; add a test that asserts the headers.

Pitfalls

X-Frame-Options: DENY blocks legitimate embedding you may need; use frame-ancestors with the allowed origins instead. Headers set only on HTML but not on API or error responses. Cross-origin isolation headers can break third-party widgets.