HTTP Security

XSS allows attackers to inject malicious scripts into pages viewed by other users. Injected scripts run with the full privileges of the target origin – they can steal cookies, capture keystrokes, and make authenticated API calls. Content-Security-Policy is the primary HTTP-level defense.

CORS controls which origins can read responses from your API. The browser enforces CORS – servers declare policy via response headers. A wildcard Access-Control-Allow-Origin: * combined with credentials is a critical misconfiguration that exposes the API to any malicious website.

CSRF tricks an authenticated user's browser into making unauthorized requests to a server. The server cannot distinguish a legitimate request from a forged one because both carry the same session cookie. SameSite=Strict cookies and CSRF tokens are the primary defenses.

HSTS tells browsers to only connect to your site over HTTPS, never HTTP. Once a browser sees the Strict-Transport-Security header, it refuses to make unencrypted connections to that domain for the duration of max-age. The HSTS preload list extends this to first-time visitors.

Session cookies are high-value targets. The HttpOnly flag prevents JavaScript access, Secure restricts to HTTPS, and SameSite=Strict blocks cross-site sending. The __Host- prefix enforces the strongest binding – requiring Secure, no Domain attribute, and Path=/. All four together make cookie theft and CSRF extremely difficult.

Clickjacking overlays an invisible iframe of your site over a malicious page. Users think they're clicking the malicious page's UI but are actually clicking your site. X-Frame-Options and Content-Security-Policy frame-ancestors prevent your pages from being embedded in iframes.

Rate limiting protects APIs from abuse, brute force, and DoS by capping how many requests a client can make in a time window. Return HTTP 429 Too Many Requests with a Retry-After header when the limit is exceeded. Implement at the API gateway or reverse proxy layer, not in application code.

Content negotiation headers (Accept, Content-Type) are attack surfaces. Servers that accept any Content-Type without validation, perform MIME sniffing, or reflect user-controlled Accept headers unsanitized are vulnerable to injection and information disclosure. X-Content-Type-Options: nosniff disables MIME sniffing.