HTTP · Cookies, CORS and security headers
Content-Security-Policy: limit what loads
Restricts where scripts, styles and images may come from, which reduces the impact of XSS.
Content-Security-Policy: default-src 'self'; img-src 'self' data:
More cookies, cors and security headers commands
- Set a secure session cookie
- Allow a cross-origin site (CORS)
- Answer a CORS preflight
- Strict-Transport-Security: force HTTPS
- X-Content-Type-Options: stop type guessing
- Block clickjacking
All cookies, cors and security headers commands · HTTP cheatsheet