HTTP Security Headers
debt(d3/e2/b2/t5)
Closest to 'default linter catches the common case' (d3), since securityheaders.com, OWASP ZAP, and Lighthouse readily flag missing headers in any automated scan — it's not silent, but you do need to actually run a scanner.
Closest to 'one-line patch or single-call swap' (e1), bumped slightly to 2 because the quick_fix is literally adding 5 header lines in one central response/middleware location — trivial but multi-line.
Closest to 'localised tax' (b3), scored 2 because headers are typically set once in a middleware or front controller; they apply web-context only and don't shape the rest of the codebase.
Closest to 'notable trap most devs eventually learn' (t5), grounded in the misconception that headers alone secure a site, plus subtle gotchas like X-Frame-Options vs CSP frame-ancestors and permissive CSP directives negating protection.
Also Known As
TL;DR
Explanation
Key security headers and their purpose: Content-Security-Policy (restricts resource loading, mitigates XSS), X-Frame-Options (prevents clickjacking — superseded by CSP frame-ancestors), X-Content-Type-Options: nosniff (prevents MIME-type sniffing), Referrer-Policy (controls referrer leakage), Permissions-Policy (restricts browser feature access), Strict-Transport-Security (enforces HTTPS), and Cross-Origin-Opener-Policy/Cross-Origin-Embedder-Policy (isolation for SharedArrayBuffer). Use securityheaders.com to audit. In PHP, emit all headers before output.
Common Misconception
Why It Matters
Common Mistakes
- Not setting Content-Security-Policy — leaves XSS execution unrestricted even after injection.
- Omitting X-Content-Type-Options: nosniff — browsers may interpret uploaded files as executable.
- Setting X-Frame-Options instead of CSP frame-ancestors — the latter supersedes it in modern browsers.
- Using a permissive CSP like unsafe-inline or unsafe-eval which negates most of its protection.
Code Examples
// No security headers set — default browser behaviourheader('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Permissions-Policy: geolocation=(), microphone=()');