HTTP cheatsheet
HTTP: Cookies, CORS and security headers
7 common HTTP tasks.
Set a secure session cookie
HttpOnly hides it from JavaScript, Secure restricts it to HTTPS, and SameSite limits cross-site sending.
Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=3600
Allow a cross-origin site (CORS)
Lets a browser app on another origin read the response. Avoid * for requests with credentials.
Access-Control-Allow-Origin: https://app.example.com
Answer a CORS preflight
The headers a server returns to an OPTIONS preflight request.
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 600
Strict-Transport-Security: force HTTPS
Tells browsers to use HTTPS only for this site for a year.
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: limit what loads
Restricts where scripts, styles and images may come from, which reduces the impact of XSS.
Content-Security-Policy: default-src 'self'; img-src 'self' data:
X-Content-Type-Options: stop type guessing
Stops browsers guessing a file's type from its content.
X-Content-Type-Options: nosniff
Block clickjacking
Prevents other sites from embedding your pages in frames.
Content-Security-Policy: frame-ancestors 'none'