• 16 Years Web Development
• Owner Foundeo Inc. Consulting & Products company.
• Blog: petefreitag.com
• Twitter: @pfreitag

• The Basics - What is a HTTP Header
• HTTP Strict Transport Security (HSTS)
• X-Frame-Options
• Content-Security-Policy
• Cookies

HTTP/1.1 200 OK
Date: Tue, 1 Apr 2014 19:58:49 GMT
Server: Apache
Content-Type: text/plain
Hello World.

 <cfheader name="X-Cow" value="moo">

HTTP/1.1 200 OK
Date: Tue, 1 Apr 2014 19:58:49 GMT
X-Cow: moo
Server: Apache
Content-Type: text/plain
Hello World.

• Passive Network Attacks - man in the middle attacks, HTTPS stripping attacks. 
  

• Active Network Attacks - compromised DNS, evil twin domains, etc.
  
• Mixed Content Vulnerabilities - loading of an insecure resource over a secure request (eg swf)
  
• Performance - removes unnecessary redirects to HTTPS from http.
  
• Because no one types https:// in the address bar.

• max-age - number of seconds policy should be kept for.
• includeSubDomains  - apply this policy to all subdomains of the requested host. Omit to apply policy only to current domain.
  
  

• Requests Over HTTP (Non Secure)
  
  
• Should respond with a 301 redirect to the secure url.
• Must NOT respond with Strict-Transport-Security header on non-secure HTTP requests.
  
  
• Requests Over HTTPS
  
  
• Should always respond with a Strict-Transport-Security header.

• Chrome: 4+
• Firefox: 4+ 
• Safari: 7+
• IE: In Development

• HSTS Specification: https://tools.ietf.org/html/rfc6797
• OWASP: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
• IIS Module: http://hstsiis.codeplex.com/

• AKA UI Redressing
• Attacker tricks the user into clicking on something that performs an unintended action.

• DENY - Specifies that the requested resource should never be embedded in a frame.
• SAMEORIGIN - Only pages on the same domain may frame the requested resource.
• ALLOW-FROM origin - Allow a whitelisted origin to frame the requested content.

• IE: 8+ (ALLOW-FROM 9+)
• FF: 3.6.9 (ALLOW-FROM 18+)
• Chrome: 4.1 (ALLOW-FROM not supported)
• Safari: 4+ (ALLOW-FROM not supported)

• http://tools.ietf.org/html/rfc7034
  
• https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

• Greatly reduces success of Cross Site Scripting (XSS) attacks.
• Report / log xss attack attempts

• When script-src or style-src
   are enabled inline style
   or script
   tags are disabled.  
• You can add 'unsafe-inline' to allow it, but defeats much of CSP's purpose.

• CSP also disables unsafe dynamic code evaluation, such as the JavaScript eval() function.
• You can add 'unsafe-eval' to a script-src directive to disable this.
  

• Specify a report-uri to receive JSON violation reports
  
• Report only: Content-Security-Policy-Report-Only

• Updated version of the CSP spec is now in Editors Draft
• Adds nonce and hash
• Adds referrer directive

• Chrome: 25+
  
• FireFox: 23+
• Safari: 7+
• IE: Not Supported Yet
• IE 10 supports the sandbox directive only via X-Content-Security-Policy
• Vendor prefixes, such as X-Content-Security-Policy and X-Webkit-CSP

• content-security-policy.com - quick reference
• www.w3.org/TR/CSP/ - CSP 1.0 Spec W3C Candidate Recommendation 
  
• www.w3.org/TR/CSP11/ - CSP 1.1 Working Draft
  
• www.w3.org/2011/webappsec/ - W3C WebAppSec Working Group
  

• X-XSS-Protection: 0 (ignore)
• X-XSS-Protection: 1 (fliter)
• X-XSS-Protection: 1; mode=block (block)
• CSP 1.1 Adds a directive reflected-xss to control this.

• HTTPOnly
• Secure

• Browser makes the cross origin request if method is GET, HEAD or POST and sends an Origin  request header.
  
• Request responds with a Access-Control-Allow-Origin  HTTP response header.
  

• If you need to make a cross origin request that is not GET, HEAD or POST, sends credentials, custom headers or a request body.
• The browser will send a preflight request, using the OPTIONS HTTP request method.

• Origin - the origin of the preflight request
• Access-Control-Request-Method - The HTTP request method that the request would send.
• Access-Control-Request-Headers - A comma separated list of header names that the request will use.

• Access-Control-Allow-Origin - An Origin, "*", or "none"
• Access-Control-Allow-Credentials - When true the request can include credentials.
  
• Access-Control-Allow-Headers - tells which request headers can be sent.
• Access-Control-Allow-Methods  - tells which HTTP methods can be used for the request.
• Access-Control-Expose-Headers - tells which response headers are available to JavaScript.
• Access-Control-Max-Age - max seconds to cache preflight response