+APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

To protect against clickjacking, cross-site scripting, and other attacks, the IT Operation Department SHOULD set appropriate HTTP response headers. At minimum, the following HTTP headers SHOULD be used:

  • Content-Security-Policy
  • Strict-Transport-Security
  • Content-Type
  • X-Content-Type-Options
  • Cache-Control

The HTTP headers used SHOULD be as restrictive as possible.

Cookies SHOULD always be set with the attributes secure, SameSite, and httponly.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos

Pedidos ligados

Ligações
blocks G 0.14 Interception of Information / Espionage
blocks G 0.23 Unauthorised Access to IT Systems