api: YAML JSON TOON Database
version: 1.0.0
format: json
dataset:
  id: 1004
  slug: http-security-headers
  title: Browser Security Headers Reference
  description: "Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites."
  summary: "Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites. Each row includes a practical application and a failure to check before using it."
  use_when[2]: Review response headers before a website launch.,Roll out a policy while observing compatibility failures.
  caveats[2]: "Examples are starting points, not a universal policy.",Headers complement application security; they do not fix vulnerable code.
  related[2]: http-response-headers,web-accessibility-patterns
  category: Web Technologies
  category_slug: web-technologies
  tags: "web-technologies,http security headers,reference,engineering"
  view_count: 0
  created_at: 1791798640
  updated_at: 1791798640
  reviewed_at: 2026-10-12
  sources[2]{title,url}:
    MDN HTTP header reference,"https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers"
    W3C Content Security Policy,"https://www.w3.org/TR/CSP3/"
  reading[1]: security-headers-without-breaking-your-site
  provenance: "Original editorial reference notes by YJTOON, informed by the linked primary documentation. External specifications retain their own licenses."
  entry_count: 10
  fields[4]{section,field,type,example}:
    data,header,string,Content-Security-Policy
    data,example,string,default-src 'self'; object-src 'none'; base-uri…
    data,purpose,string,Constrain resource loading and script execution.
    data,deployment_check,string,Inventory third-party resources before enforcin…
data[10]{header,example,purpose,deployment_check}:
  Content-Security-Policy,default-src 'self'; object-src 'none'; base-uri 'self',Constrain resource loading and script execution.,Inventory third-party resources before enforcing a policy.
  Content-Security-Policy-Report-Only,default-src 'self',Collect policy violations without enforcing the policy.,"Use reports to find real dependencies, not as protection."
  Strict-Transport-Security,max-age=31536000,Tell HTTPS clients to use secure transport for this host.,Enable only when HTTPS works for the entire policy lifetime.
  X-Content-Type-Options,nosniff,Reduce MIME-type interpretation surprises.,Serve correct Content-Type values for scripts and styles.
  Referrer-Policy,strict-origin-when-cross-origin,Limit information sent in referrer headers.,Check cross-origin analytics and link requirements.
  Permissions-Policy,"camera=(), microphone=(), geolocation=()",Restrict selected browser capabilities.,Supported directive names differ by browser.
  Cross-Origin-Opener-Policy,same-origin,Separate browsing context groups across origins.,Test popup-based login and payment flows.
  Cross-Origin-Embedder-Policy,require-corp,Require embedding permissions for cross-origin resources.,Cross-origin media may stop loading without suitable headers.
  Cross-Origin-Resource-Policy,same-origin,Restrict who may load a resource in no-cors mode.,Use a broader policy for intentionally public assets.
  X-Frame-Options,DENY,Block framing in supporting browsers.,Prefer CSP frame-ancestors for a modern framing policy.