HTTP security headers in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

📋 Factual

intermediate

What is the primary purpose of the Content-Security-Policy header?

The Content-Security-Policy (CSP) header is used in web security. What does it mainly help prevent?

A It restricts the sources from which a browser can load resources to prevent cross-site scripting attacks.

B It encrypts the data sent between the browser and server to prevent eavesdropping.

C It forces the browser to only use HTTPS connections for all requests.

D It hides the server software version to prevent targeted attacks.

💡 Hint

Think about how websites control what scripts or content can run on their pages.

The Content-Security-Policy header tells the browser which sources of content are allowed. This helps stop attackers from injecting malicious scripts, a common method in cross-site scripting (XSS) attacks.

🧠 Conceptual

intermediate

How does the Strict-Transport-Security header improve security?

What effect does the Strict-Transport-Security (HSTS) header have on a user's browser?

A It tells the browser to always use HTTPS for future requests to the site, preventing downgrade attacks.

B It blocks all cookies from being sent to the server to protect privacy.

C It disables JavaScript execution on the website to prevent malicious scripts.

D It forces the browser to clear its cache when visiting the site.

💡 Hint

Consider how browsers handle secure connections and what can happen if they switch to insecure ones.

HSTS tells browsers to only connect to the site using HTTPS for a set time. This stops attackers from tricking browsers into using insecure HTTP, which can be intercepted.

🔍 Analysis

advanced

Identify the effect of the following header on browser behavior

Given the HTTP header:

Referrer-Policy: no-referrer-when-downgrade

What does this header instruct the browser to do?

A Always send the full URL as referrer, even when moving to less secure sites.

B Never send any referrer information regardless of the destination.

C Send only the origin part of the URL as referrer for all requests.

D Send the full URL as referrer only when navigating to the same or more secure protocol, but not when going to less secure sites.

💡 Hint

Think about what 'downgrade' means in terms of security protocols.

This policy sends the full referrer URL only when navigating to the same or a more secure protocol (like HTTPS to HTTPS). It blocks sending referrer info when moving from HTTPS to HTTP to protect privacy.

❓ Comparison

advanced

Compare X-Frame-Options and Content-Security-Policy frame-ancestors directives

Both X-Frame-Options and the frame-ancestors directive in Content-Security-Policy control framing of a webpage. Which statement correctly compares their capabilities?

A X-Frame-Options can specify multiple domains, but frame-ancestors only allows a single domain.

B Both headers are deprecated and have no effect on modern browsers.

C X-Frame-Options supports only a few fixed options, while frame-ancestors allows specifying multiple allowed domains and is more flexible.

D frame-ancestors only works in Internet Explorer, while X-Frame-Options works in all browsers.

💡 Hint

Consider which header offers more detailed control over allowed framing sources.

X-Frame-Options is limited to 'DENY', 'SAMEORIGIN', or 'ALLOW-FROM' with a single allowed domain. The frame-ancestors directive in CSP allows listing multiple domains and wildcards, offering finer control over who can embed the page.

❓ Reasoning

expert

Why might setting the X-Content-Type-Options header to 'nosniff' be critical?

What security risk does setting X-Content-Type-Options: nosniff help prevent?

A It encrypts the content to prevent interception during transmission.

B It stops browsers from guessing the MIME type, preventing execution of malicious files disguised with wrong extensions.

C It disables all inline scripts on the webpage to block cross-site scripting.

D It forces the browser to cache all content for faster loading.

💡 Hint

Think about how browsers handle files when the declared content type might be incorrect or missing.

Without this header, browsers may try to guess the file type and run scripts or styles that are actually harmful. Setting 'nosniff' stops this guessing, reducing risks like drive-by downloads or XSS.