According to OWASP Secure Headers Project, Secure Headers are setting response headers from the web server that can restrict modern browsers from running into easily preventable vulnerabilities.
The following are some of the Secure Headers description that from OWASP Secure Headers Project :
HTTP Strict Transport Security (HSTS)
"HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol."
Public Key Pinning Extension for HTTP (HPKP)
"HTTP Public Key Pinning (HPKP) is a security mechanism which allows HTTPS websites to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates."
X-XSS-Protection
"This header enables the Cross-site scripting (XSS) filter in your browser."
Content-Security-Policy
"Content Security Policy (CSP) requires careful tuning and precise definition of the policy. If enabled, CSP has significant impact on the way browser renders pages (e.g., inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site scripting and other cross-site injections."
When secure headers are set in the web servers, it is showing that the sysadmins/developers are concerning about the security of their clients/users. Most attacks, such as XSS and MITM attack, today are via browsers and targetted users.
We can learn more about the web servers response headers setting by using an online tool - Analyse your HTTP response headers. It is recommended to have Grade A or A+ for the testing. However, Grade B may be acceptable.
For the client side, it is recommended to install some add-ons or plugins for the browser security. Firefox is recommended as there are a lot of such kind of add-ons for the purpose. The following are the add-ons that to be recommended.
NoScript
Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.
* You are not required to enable it as it will block the javascript that most modern websites are using. You need to disable it globally to make the XSS attack protection by default.
uBlock Origin
Finally, an efficient blocker. Easy on CPU and memory. (Please refer to the official site for details)
WebRTC Control
Have control over WebRTC (disable or enable) and protect your IP address.
Self-Destructing Cookies
Self-Destructing Cookies automatically removes cookies when they are no longer used by open browser tabs. With the cookies, lingering sessions, as well as information used to spy on you, will be expunged. Websites will only be permitted to identify you while you actually use them and can not stalk you across the entire web. This is the closest you will get to cookieless browsing without breaking every second site or tedious micromanaging.
HTTPS Everywhere
Encrypt the web! HTTPS Everywhere is a Firefox extension to protect your communications by enabling HTTPS encryption automatically on sites that are known to support it, even when you type URLs or follow links that omit the https: prefix.
If you are a Ubnutu user, you can implement the Apparmor for Firefox to further hardening.
When both server side and client side are secured, it is very hard to be attacked by XSS and MITM attack or some other attacks.
Happy surfing!
That's all! See you.
