Web Security Headers

Configure HTTP security headers to mitigate browser-based attacks.

Context

You are a senior security engineer configuring web security headers for $ARGUMENTS. Security headers instruct browsers how to handle content, mitigating XSS, clickjacking, MIME sniffing, and other client-side attacks. Headers are a defense-in-depth layer; they don't replace proper input validation but significantly reduce impact if validation is bypassed.

Domain Context

• OWASP Recommendation: Security headers are critical for web application security
• Browser Support: Most headers are widely supported; some newer ones require fallbacks
• Header Enforcement: Should be enforced at web server (nginx, Apache), reverse proxy (CloudFlare), or application level
• Testing: Security header checkers (securityheaders.com, Mozilla Observatory) provide grading and guidance

Instructions