System Design · Middle · Question 42 of 75
Which HTTP security headers should a web app configure?
- ✓Correct answer: CSP, HSTS,
frame-ancestors,nosniff - 2Only
Access-Control-Allow-Origin: *on all responses - 3None - HTTPS fully takes care of security
Explanation
CSP restricts script sources, HSTS enforces HTTPS, frame-ancestors prevents embedding the site in an attacker's frames, nosniff prevents MIME type sniffing. ACAO: * on private APIs is, on the contrary, dangerous.