HTTP security headers in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to add a header that prevents browsers from loading the page in a frame.

Cybersecurity

response.headers['[1]'] = 'DENY'

Drag options to blanks, or click blank then click option'

AX-Frame-Options

BContent-Security-Policy

CStrict-Transport-Security

DX-Content-Type-Options

Attempts:

3 left

💡 Hint

Common Mistakes

Using Content-Security-Policy instead of X-Frame-Options

Confusing with Strict-Transport-Security

The X-Frame-Options header tells browsers not to allow the page to be displayed in a frame or iframe, protecting against clickjacking attacks.

2fill in blank

medium

Complete the code to add a header that forces browsers to use HTTPS for all requests.

Cybersecurity

response.headers['[1]'] = 'max-age=31536000; includeSubDomains'

Drag options to blanks, or click blank then click option'

AStrict-Transport-Security

BReferrer-Policy

CX-Content-Type-Options

DX-Frame-Options

Attempts:

3 left

💡 Hint

Common Mistakes

Using X-Frame-Options instead

Confusing with Content-Security-Policy

The Strict-Transport-Security header tells browsers to only use HTTPS for the site and its subdomains for the specified time.

3fill in blank

hard

Fix the error in the header that stops browsers from sniffing content types.

Cybersecurity

response.headers['X-Content-Type-Options'] = '[1]'

Drag options to blanks, or click blank then click option'

Ano-sniff

Bnosniff

Cnone

Doff

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'no-sniff' instead of 'nosniff'

Using 'none' or 'off' which are invalid

The correct value for X-Content-Type-Options to prevent MIME sniffing is nosniff.

4fill in blank

hard

Fill both blanks to add a Content Security Policy that only allows scripts from the same origin and blocks inline scripts.

Cybersecurity

response.headers['[1]'] = "script-src 'self' [2]"

Drag options to blanks, or click blank then click option'

AContent-Security-Policy

B'unsafe-inline'

C'none'

D'strict-origin'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'unsafe-inline' which allows inline scripts

Using wrong header names

The Content-Security-Policy header controls allowed sources. Using 'none' blocks inline scripts, enhancing security.

5fill in blank

hard

Fill both blanks to add a Referrer Policy header that sends no referrer information on cross-origin requests.

Cybersecurity

response.headers['[1]'] = '[2]'

Drag options to blanks, or click blank then click option'

AReferrer-Policy

Bno-referrer

Cstrict-origin-when-cross-origin

Dorigin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'strict-origin-when-cross-origin' which sends partial info

Using 'origin' which sends origin only

The Referrer-Policy header controls how much referrer info is sent. no-referrer means no referrer is sent at all.

Practice

1. Which HTTP security header helps prevent your website from being embedded in frames or iframes on other sites to avoid clickjacking attacks?

easy

A. X-Frame-Options

B. Strict-Transport-Security

C. Content-Security-Policy

D. Cache-Control

Solution

1. Step 1: Understand the purpose of X-Frame-Options

   This header tells browsers whether your site can be shown inside frames or iframes, which helps prevent clickjacking.

2. Step 2: Compare with other headers

   Strict-Transport-Security enforces HTTPS, Content-Security-Policy controls resource loading, and Cache-Control manages caching, none prevent framing.

3. Final Answer:

   X-Frame-Options -> Option A

4. Quick Check:

   Clickjacking protection = X-Frame-Options [OK]

Hint: Frames blocked by X-Frame-Options header [OK]

Common Mistakes:

• Confusing Strict-Transport-Security with frame protection
• Thinking Content-Security-Policy blocks framing by default
• Assuming Cache-Control affects framing

2. Which of the following is the correct syntax to set the Strict-Transport-Security header to enforce HTTPS for one year?

easy

A. Strict-Transport-Security: max-age=3600

B. Strict-Transport-Security: secure=yes

C. Strict-Transport-Security: enable=true

D. Strict-Transport-Security: max-age=31536000

Solution

1. Step 1: Recall the max-age value meaning

   max-age is the time in seconds the browser should enforce HTTPS. One year equals 31,536,000 seconds.

2. Step 2: Check the options for correct syntax

   Strict-Transport-Security: max-age=31536000 uses max-age=31536000 which is one year. Others use wrong values or invalid syntax.

3. Final Answer:

   Strict-Transport-Security: max-age=31536000 -> Option D

4. Quick Check:

   One year max-age = 31536000 seconds [OK]

Hint: One year in seconds is 31536000 for max-age [OK]

Common Mistakes:

• Using max-age=3600 which is only one hour
• Using invalid parameters like enable or secure
• Confusing max-age units (seconds vs minutes)

3. Given this HTTP response header:
Content-Security-Policy: default-src 'self'; img-src https://images.example.com;
What will happen if the webpage tries to load an image from https://cdn.example.com/pic.jpg?

medium

A. The image will be blocked by the browser.

B. The entire page will fail to load.

C. The image will load successfully.

D. The browser will ignore the Content-Security-Policy header.

Solution

1. Step 1: Analyze the Content-Security-Policy rules

   default-src 'self' allows resources only from the same origin. img-src allows images only from https://images.example.com.

2. Step 2: Check the image source against allowed domains

   https://cdn.example.com is not allowed by img-src, so the browser blocks the image.

3. Final Answer:

   The image will be blocked by the browser. -> Option A

4. Quick Check:

   Image source not in img-src whitelist = blocked [OK]

Hint: Only allowed domains in img-src load images [OK]

Common Mistakes:

• Assuming default-src allows all images
• Thinking browser ignores CSP headers
• Believing the whole page fails if one image blocked

4. A website sets the header X-Content-Type-Options: nosniff but users report some images are not displaying. What is the most likely cause?

medium

A. The images are blocked by Content-Security-Policy.

B. The browser does not support the nosniff option.

C. The server is sending incorrect MIME types for images.

D. The Strict-Transport-Security header is missing.

Solution

1. Step 1: Understand the effect of X-Content-Type-Options: nosniff

   This header tells browsers to trust the declared MIME type and not guess the content type.

2. Step 2: Identify why images might not display

   If the server sends wrong MIME types for images, browsers will block them due to nosniff enforcement.

3. Final Answer:

   The server is sending incorrect MIME types for images. -> Option C

4. Quick Check:

   nosniff blocks mismatched MIME types [OK]

Hint: nosniff blocks wrong MIME types from loading [OK]

Common Mistakes:

• Blaming browser support instead of server MIME types
• Confusing CSP blocking with nosniff effects
• Thinking missing Strict-Transport-Security causes image issues

5. You want to improve your website's security by enforcing HTTPS and preventing clickjacking. Which combination of HTTP headers should you set?

hard

A. Content-Security-Policy and Cache-Control

B. Strict-Transport-Security and X-Frame-Options

C. X-Content-Type-Options and Content-Security-Policy

D. Cache-Control and Strict-Transport-Security

Solution

1. Step 1: Identify header for enforcing HTTPS

   Strict-Transport-Security tells browsers to use HTTPS only, improving connection security.

2. Step 2: Identify header for preventing clickjacking

   X-Frame-Options prevents the site from being framed, stopping clickjacking attacks.

3. Step 3: Evaluate other options

   Content-Security-Policy controls resource loading but does not enforce HTTPS or prevent framing alone. Cache-Control manages caching, not security.

4. Final Answer:

   Strict-Transport-Security and X-Frame-Options -> Option B

5. Quick Check:

   HTTPS + clickjacking protection = Strict-Transport-Security + X-Frame-Options [OK]

Hint: Use Strict-Transport-Security + X-Frame-Options for HTTPS and framing [OK]

Common Mistakes:

• Confusing Cache-Control as security header
• Thinking Content-Security-Policy alone prevents clickjacking
• Ignoring HTTPS enforcement in header choice