HTTP Header Security
HTTP response security headers are a set of standard HTTP response headers proposed to prevent or mitigate known XSS, clickjacking, and MIME sniffing security vulnerabilities. These response headers define security policies to client browsers so that the browsers avoid exposure to known vulnerabilities when handling requests.
When enabling this feature, headers with specified values are inserted into HTTP responses coming from the backend web servers. This is a quick and simple solution to address the security vulnerabilities on your website without code and configuration changes. The following includes the security headers that FortiAppSec Cloud can insert into responses.
To configure HTTP Header Security, you must have already enabled this module in Add Modules. See Add and Remove Modules.
|
X-Frame-Options |
This header prevents browsers from Clickjacking attacks by providing appropriate restrictions on displaying pages in frames. |
|
X-Content-Type-Options |
This header prevents browsers from MIME content-sniffing attacks by disabling the browser's MIME sniffing function. |
|
X-XSS-Protection |
This header enables a browser's built-in Cross-site scripting (XSS) protection. |
|
Content-Security-Policy |
Enable to prevent certain types of attacks, including XSS and data injection attacks by inserting this header (e.g. default-src 'self'; script-src 'self'; object-src 'self'). |
|
Referrer-Policy |
Referrer-Policy HTTP header controls how much referrer information (sent via the Referer header) should be included with requests. The Referrer-Policy Value can be the following:
|