Web Security and WAF · Defense in Depth: Headers, WAF, Edge and SDLC
TLS and Security Headers
Encrypt everything and let browsers enforce extra protections.
Serve everything over TLS 1.2+/1.3 with HSTS (Strict-Transport-Security) so browsers never downgrade to HTTP. Add security headers: Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and frame-ancestors (or X-Frame-Options) against clickjacking. Use secure cookie flags. Automate certificates (ACME/Let's Encrypt) and test configuration regularly.
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; object-src 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-Policy: same-origin
Common pitfalls
- HSTS preload without ensuring all subdomains support HTTPS.
- Headers set on some responses but not error pages or APIs.
- Expired certificates due to manual renewal.
Key points
- TLS everywhere + HSTS
- CSP, nosniff, Referrer-Policy, frame-ancestors
- Automate certificates
Further reading: OWASP HTTP Headers Cheat Sheet
Practice questions
What attack does HSTS prevent?
Answer
SSL stripping/downgrade: after the first visit, the browser refuses plain HTTP for the domain, so attackers can't intercept an initial HTTP request.
How do you prevent clickjacking?
Answer
Send Content-Security-Policy: frame-ancestors 'none' (or 'self'), or the older X-Frame-Options: DENY, so other sites can't frame your pages.
Open in the app to mark lessons complete, take notes and track your progress.