HTTP security headers in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add a header that prevents browsers from loading the page in a frame.

Cybersecurity

response.headers['[1]'] = 'DENY'

Drag options to blanks, or click blank then click option'

AX-Frame-Options

BContent-Security-Policy

CStrict-Transport-Security

DX-Content-Type-Options

Attempts:

3 left

💡 Hint

Common Mistakes

Using Content-Security-Policy instead of X-Frame-Options

Confusing with Strict-Transport-Security

The X-Frame-Options header tells browsers not to allow the page to be displayed in a frame or iframe, protecting against clickjacking attacks.

2fill in blank

medium

Complete the code to add a header that forces browsers to use HTTPS for all requests.

Cybersecurity

response.headers['[1]'] = 'max-age=31536000; includeSubDomains'

Drag options to blanks, or click blank then click option'

AStrict-Transport-Security

BReferrer-Policy

CX-Content-Type-Options

DX-Frame-Options

Attempts:

3 left

💡 Hint

Common Mistakes

Using X-Frame-Options instead

Confusing with Content-Security-Policy

The Strict-Transport-Security header tells browsers to only use HTTPS for the site and its subdomains for the specified time.

3fill in blank

hard

Fix the error in the header that stops browsers from sniffing content types.

Cybersecurity

response.headers['X-Content-Type-Options'] = '[1]'

Drag options to blanks, or click blank then click option'

Ano-sniff

Bnosniff

Cnone

Doff

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'no-sniff' instead of 'nosniff'

Using 'none' or 'off' which are invalid

The correct value for X-Content-Type-Options to prevent MIME sniffing is nosniff.

4fill in blank

hard

Fill both blanks to add a Content Security Policy that only allows scripts from the same origin and blocks inline scripts.

Cybersecurity

response.headers['[1]'] = "script-src 'self' [2]"

Drag options to blanks, or click blank then click option'

AContent-Security-Policy

B'unsafe-inline'

C'none'

D'strict-origin'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'unsafe-inline' which allows inline scripts

Using wrong header names

The Content-Security-Policy header controls allowed sources. Using 'none' blocks inline scripts, enhancing security.

5fill in blank

hard

Fill both blanks to add a Referrer Policy header that sends no referrer information on cross-origin requests.

Cybersecurity

response.headers['[1]'] = '[2]'

Drag options to blanks, or click blank then click option'

AReferrer-Policy

Bno-referrer

Cstrict-origin-when-cross-origin

Dorigin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'strict-origin-when-cross-origin' which sends partial info

Using 'origin' which sends origin only

The Referrer-Policy header controls how much referrer info is sent. no-referrer means no referrer is sent at all.