+APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

To protect against clickjacking, cross-site scripting, and other attacks, the IT Operation Department SHOULD set appropriate HTTP response headers. At minimum, the following HTTP headers SHOULD be used:

  • Content-Security-Policy
  • Strict-Transport-Security
  • Content-Type
  • X-Content-Type-Options
  • Cache-Control

The HTTP headers used SHOULD be as restrictive as possible.

Cookies SHOULD always be set with the attributes secure, SameSite, and httponly.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
blocks G 0.14 Interception of Information / Espionage
blocks G 0.23 Unauthorised Access to IT Systems