{
    "api": "YAML JSON TOON Database",
    "version": "1.0.0",
    "format": "json",
    "dataset": {
        "id": 1004,
        "slug": "http-security-headers",
        "title": "Browser Security Headers Reference",
        "description": "Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites.",
        "summary": "Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites. Each row includes a practical application and a failure to check before using it.",
        "use_when": [
            "Review response headers before a website launch.",
            "Roll out a policy while observing compatibility failures."
        ],
        "caveats": [
            "Examples are starting points, not a universal policy.",
            "Headers complement application security; they do not fix vulnerable code."
        ],
        "related": [
            "http-response-headers",
            "web-accessibility-patterns"
        ],
        "category": "Web Technologies",
        "category_slug": "web-technologies",
        "tags": "web-technologies,http security headers,reference,engineering",
        "view_count": 0,
        "created_at": 1791798640,
        "updated_at": 1791798640,
        "reviewed_at": "2026-10-12",
        "sources": [
            {
                "title": "MDN HTTP header reference",
                "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers"
            },
            {
                "title": "W3C Content Security Policy",
                "url": "https://www.w3.org/TR/CSP3/"
            }
        ],
        "reading": [
            "security-headers-without-breaking-your-site"
        ],
        "provenance": "Original editorial reference notes by YJTOON, informed by the linked primary documentation. External specifications retain their own licenses.",
        "entry_count": 10,
        "fields": [
            {
                "section": "data",
                "field": "header",
                "type": "string",
                "example": "Content-Security-Policy"
            },
            {
                "section": "data",
                "field": "example",
                "type": "string",
                "example": "default-src 'self'; object-src 'none'; base-uri…"
            },
            {
                "section": "data",
                "field": "purpose",
                "type": "string",
                "example": "Constrain resource loading and script execution."
            },
            {
                "section": "data",
                "field": "deployment_check",
                "type": "string",
                "example": "Inventory third-party resources before enforcin…"
            }
        ]
    },
    "data": [
        {
            "header": "Content-Security-Policy",
            "example": "default-src 'self'; object-src 'none'; base-uri 'self'",
            "purpose": "Constrain resource loading and script execution.",
            "deployment_check": "Inventory third-party resources before enforcing a policy."
        },
        {
            "header": "Content-Security-Policy-Report-Only",
            "example": "default-src 'self'",
            "purpose": "Collect policy violations without enforcing the policy.",
            "deployment_check": "Use reports to find real dependencies, not as protection."
        },
        {
            "header": "Strict-Transport-Security",
            "example": "max-age=31536000",
            "purpose": "Tell HTTPS clients to use secure transport for this host.",
            "deployment_check": "Enable only when HTTPS works for the entire policy lifetime."
        },
        {
            "header": "X-Content-Type-Options",
            "example": "nosniff",
            "purpose": "Reduce MIME-type interpretation surprises.",
            "deployment_check": "Serve correct Content-Type values for scripts and styles."
        },
        {
            "header": "Referrer-Policy",
            "example": "strict-origin-when-cross-origin",
            "purpose": "Limit information sent in referrer headers.",
            "deployment_check": "Check cross-origin analytics and link requirements."
        },
        {
            "header": "Permissions-Policy",
            "example": "camera=(), microphone=(), geolocation=()",
            "purpose": "Restrict selected browser capabilities.",
            "deployment_check": "Supported directive names differ by browser."
        },
        {
            "header": "Cross-Origin-Opener-Policy",
            "example": "same-origin",
            "purpose": "Separate browsing context groups across origins.",
            "deployment_check": "Test popup-based login and payment flows."
        },
        {
            "header": "Cross-Origin-Embedder-Policy",
            "example": "require-corp",
            "purpose": "Require embedding permissions for cross-origin resources.",
            "deployment_check": "Cross-origin media may stop loading without suitable headers."
        },
        {
            "header": "Cross-Origin-Resource-Policy",
            "example": "same-origin",
            "purpose": "Restrict who may load a resource in no-cors mode.",
            "deployment_check": "Use a broader policy for intentionally public assets."
        },
        {
            "header": "X-Frame-Options",
            "example": "DENY",
            "purpose": "Block framing in supporting browsers.",
            "deployment_check": "Prefer CSP frame-ancestors for a modern framing policy."
        }
    ]
}