+APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

APP.3.1.A21 Secure HTTP Configuration of Web Applications (S)

To protect against clickjacking, cross-site scripting, and other attacks, the IT Operation Department SHOULD set appropriate HTTP response headers. At minimum, the following HTTP headers SHOULD be used:

  • Content-Security-Policy
  • Strict-Transport-Security
  • Content-Type
  • X-Content-Type-Options
  • Cache-Control

The HTTP headers used SHOULD be as restrictive as possible.

Cookies SHOULD always be set with the attributes secure, SameSite, and httponly.

1. Prehľad

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

Požiadavky

3. Súvisiace predpisy

Predpisy

Prepojené úlohy

Prepojenia
blocks G 0.14 Interception of Information / Espionage
blocks G 0.23 Unauthorised Access to IT Systems