Security Headers and CSP

• A good CSP turns a successful XSS from 'full compromise' into 'a browser error', capping the attack at the front door.
• Headers are a five-minute change with audit visibility — the highest-value-per-hour control an app has.
• Auditors check them; penetration-test reports routinely open with 'Missing security headers'.

Instead of trusting every visitor to behave, the building enforces the rules itself.

• HSTS tells browsers: always use HTTPS for this domain, never downgrade — preventing protocol-downgrade and cookie-transit attacks.
• CSP is a allow-list for script/style/frame/image sources; browsers refuse anything not named, so injected <script> dies.
• X-Content-Type-Options: nosniff stops MIME-sniffing confusion; Referrer-Policy trims the URL leaked to third parties.
• Headers ship per-response; frameworks emit them centrally (middleware) so drift is visible in CI.

• An e-commerce deployment added a strict CSP and their stored-XSS bounty submissions dropped to near zero.
• A bank enabled HSTS with includeSubDomains and saw report-only HSTS helps kill downgrade in the logs.
• A media site set Referrer-Policy to strict-origin-when-cross-origin, trimming analytics referrer noise by half.

• Start CSP in report-only mode, collect violation reports for a week, then enforce the final policy.
• Set HSTS with preload intent only after confirming you can serve HTTPS forever — preload is irreversible.
• Centralize headers in middleware so every route inherits them, then assert their presence in CI.
• Keep third-party script domains in the CSP allow-list explicit; wildcards make the policy meaningless.

• Writing a CSP with 'script-src *' which is no CSP at all.
• Using 'unsafe-inline' for scripts, gracefully deleting the XSS defense in one attribute.
• Enforcing a strict CSP before testing, breaking analytics/injections in production.
• Setting HSTS preload without HTTPS-everywhere, then watch visitors and SEO both fail.

• Read the CSP violation report from your report URI — it names the exact blocked source URL.
• Use your browser's console (CSP errors are loud) to debug in report-only first.
• If inline styles break, prefer hashes/allow-list nonces over 'unsafe-inline'.

• Assert headers in your CI pipeline, not just at manual audit time; the suite should re-run them each release.
• Third-party scripts holding a CSP allow-list entry are a supply-chain trust decision; audit their ownership.