+APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

To protect against clickjacking, cross-site scripting, and other attacks, the IT Operation Department SHOULD set appropriate HTTP response headers. At minimum, the following HTTP headers SHOULD be used:

  • Content-Security-Policy
  • Strict-Transport-Security
  • Content-Type
  • X-Content-Type-Options
  • Cache-Control

The HTTP headers used SHOULD be as restrictive as possible.

Cookies SHOULD always be set with the attributes secure, SameSite, and httponly.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις

3. Σχετικοί κανονισμοί

Κανονισμοί

Συνδεδεμένα ζητήματα

Συνδέσεις
blocks G 0.14 Interception of Information / Espionage
blocks G 0.23 Unauthorised Access to IT Systems