Cyberstudy
Supplementary — not from your PDF Intermediate ~40 min

Add security headers to a local web server

Serve a page from a local nginx container, add standard HTTP security headers, and check them with curl and your browser's developer tools.

Environment

Docker on your own PC. The server listens only on 127.0.0.1.

Before you start

  • Read Secure Coding Techniques (p.291), Application Protections (p.293) and Transport Layer Security (p.278).

You will

  • Configure response headers
  • Verify them with curl
  • Explain what each header defends against

Steps

  1. 1

    Create a folder with an index.html and a default.conf containing a normal nginx server { listen 80; root /usr/share/nginx/html; } block.

  2. 2

    Inside the server block, add: add_header X-Content-Type-Options nosniff;, add_header X-Frame-Options DENY;, add_header Referrer-Policy no-referrer; and add_header Content-Security-Policy "default-src 'self'";.

  3. 3

    Run it: docker run -d --name hdrs -p 127.0.0.1:8083:80 -v "$PWD/default.conf:/etc/nginx/conf.d/default.conf:ro" -v "$PWD:/usr/share/nginx/html:ro" nginx:alpine.

  4. 4

    Check the headers with curl -I http://127.0.0.1:8083.

  5. 5

    Open the page, press F12 → Network, click the request and find the same headers.

  6. 6

    Add an inline <script> to index.html, reload, and read the Content Security Policy message in the Console.

  7. 7

    Clean up: docker rm -f hdrs.

Check your understanding

  • ?What does a Content Security Policy restrict, and how does that limit cross-site scripting?
  • ?What does X-Frame-Options prevent?
  • ?Why would you also add Strict-Transport-Security on a real HTTPS site?