api: YAML JSON TOON Database
version: 1.0.0
format: yaml
dataset:
  id: 1590
  slug: http-security-headers
  title: Browser Security Headers Reference
  description: Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites.
  summary: Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites. Each row includes a practical application and a failure to check before using it.
  use_when:
    - Review response headers before a website launch.
    - Roll out a policy while observing compatibility failures.
  caveats:
    - Examples are starting points, not a universal policy.
    - Headers complement application security; they do not fix vulnerable code.
  related:
    - http-response-headers
    - web-accessibility-patterns
  reviewed_at: "2026-10-12"
  sources:
    - title: MDN HTTP header reference
      url: "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers"
    - title: W3C Content Security Policy
      url: "https://www.w3.org/TR/CSP3/"
  reading:
    - security-headers-without-breaking-your-site
  provenance: Original editorial reference notes by YJTOON, informed by the linked primary documentation. External specifications retain their own licenses.
  entry_count: 10
  fields:
    - section: data
      field: header
      type: string
      example: Content-Security-Policy
    - section: data
      field: example
      type: string
      example: default-src 'self'; object-src 'none'; base-uri…
    - section: data
      field: purpose
      type: string
      example: Constrain resource loading and script execution.
    - section: data
      field: deployment_check
      type: string
      example: Inventory third-party resources before enforcin…
  category: Web Technologies
  category_slug: web-technologies
  tags: web-technologies,http security headers,reference,engineering
  view_count: 1
  created_at: 1791798640
  updated_at: 1791798640
data:
  - header: Content-Security-Policy
    example: default-src 'self'; object-src 'none'; base-uri 'self'
    purpose: Constrain resource loading and script execution.
    deployment_check: Inventory third-party resources before enforcing a policy.
  - header: Content-Security-Policy-Report-Only
    example: default-src 'self'
    purpose: Collect policy violations without enforcing the policy.
    deployment_check: Use reports to find real dependencies, not as protection.
  - header: Strict-Transport-Security
    example: max-age=31536000
    purpose: Tell HTTPS clients to use secure transport for this host.
    deployment_check: Enable only when HTTPS works for the entire policy lifetime.
  - header: X-Content-Type-Options
    example: nosniff
    purpose: Reduce MIME-type interpretation surprises.
    deployment_check: Serve correct Content-Type values for scripts and styles.
  - header: Referrer-Policy
    example: strict-origin-when-cross-origin
    purpose: Limit information sent in referrer headers.
    deployment_check: Check cross-origin analytics and link requirements.
  - header: Permissions-Policy
    example: camera=(), microphone=(), geolocation=()
    purpose: Restrict selected browser capabilities.
    deployment_check: Supported directive names differ by browser.
  - header: Cross-Origin-Opener-Policy
    example: same-origin
    purpose: Separate browsing context groups across origins.
    deployment_check: Test popup-based login and payment flows.
  - header: Cross-Origin-Embedder-Policy
    example: require-corp
    purpose: Require embedding permissions for cross-origin resources.
    deployment_check: Cross-origin media may stop loading without suitable headers.
  - header: Cross-Origin-Resource-Policy
    example: same-origin
    purpose: Restrict who may load a resource in no-cors mode.
    deployment_check: Use a broader policy for intentionally public assets.
  - header: X-Frame-Options
    example: DENY
    purpose: Block framing in supporting browsers.
    deployment_check: Prefer CSP frame-ancestors for a modern framing policy.