+APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

To protect against clickjacking, cross-site scripting, and other attacks, the IT Operation Department SHOULD set appropriate HTTP response headers. At minimum, the following HTTP headers SHOULD be used:

  • Content-Security-Policy
  • Strict-Transport-Security
  • Content-Type
  • X-Content-Type-Options
  • Cache-Control

The HTTP headers used SHOULD be as restrictive as possible.

Cookies SHOULD always be set with the attributes secure, SameSite, and httponly.

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Rialacháin ghaolmhara

Rialacháin

Saincheisteanna nasctha

Naisc
blocks G 0.14 Interception of Information / Espionage
blocks G 0.23 Unauthorised Access to IT Systems