+CON.10.A14 Secure HTTP Configuration of Web Applications (S)

CON.10.A14 Secure HTTP Configuration of Web Applications (S)

To protect against clickjacking, cross-site scripting, and other attacks, Developers SHOULD set appropriate HTTP response headers. The following HTTP headers SHOULD be used at minimum: Content-Security-Policy, Strict-Transport-Security, Content-Type, X-Content-Type-Options, and Cache-Control. The HTTP headers used SHOULD be adapted to the web application at hand. The HTTP headers used SHOULD be as restrictive as possible.

Cookies SHOULD always be set with the attributes secure, SameSite, and httponly.

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai

Susietos užduotys

Saitai
blocks G 0.28 Software Vulnerabilities or Errors