Secure headers configuration in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of setting secure HTTP headers in a Flask application?

Secure HTTP headers help protect your web app from common attacks like cross-site scripting (XSS), clickjacking, and data sniffing by instructing browsers how to behave securely.

beginner

Name three common secure headers you can set in Flask.

Content-Security-Policy (CSP), X-Frame-Options, and Strict-Transport-Security (HSTS) are common secure headers to improve security.

intermediate

How can you add secure headers to all responses in a Flask app?

Use the @app.after_request decorator to modify the response object and add headers before sending it to the client.

intermediate

What does the 'Content-Security-Policy' header do?

It controls which resources (like scripts, images) the browser is allowed to load, helping prevent malicious code injection.

intermediate

Why is the 'Strict-Transport-Security' header important?

It forces browsers to use HTTPS only, preventing attackers from intercepting data over insecure HTTP connections.

Which Flask decorator is best to add secure headers to every response?

A @app.after_request

B @app.route

C @app.before_request

D @app.errorhandler

The @app.after_request decorator lets you modify the response after the view function runs, perfect for adding headers.

What does the 'X-Frame-Options' header protect against?

A Cross-site scripting

B Clickjacking

C SQL injection

D Data encryption

X-Frame-Options prevents your site from being embedded in frames or iframes, protecting against clickjacking attacks.

Which header tells browsers to only use HTTPS for your site?

A Content-Security-Policy

B X-Content-Type-Options

C Strict-Transport-Security

D Referrer-Policy

Strict-Transport-Security (HSTS) forces browsers to use HTTPS, improving security.

What is a simple way to add a Content-Security-Policy header in Flask?

A Add it in the response headers using @app.after_request

B Set it in the HTML meta tags

C Use Flask's built-in CSP function

D Modify the request headers

You add CSP by modifying the response headers, typically in an @app.after_request function.

Which header helps prevent browsers from MIME-sniffing a response away from the declared content-type?

A Strict-Transport-Security

B X-Frame-Options

C Content-Security-Policy

D X-Content-Type-Options

X-Content-Type-Options with the value 'nosniff' stops browsers from guessing the content type, reducing some attacks.

Explain how to add secure headers to all responses in a Flask app and why it is important.

Think about how Flask lets you change the response before sending it.

Describe the role of Content-Security-Policy and Strict-Transport-Security headers in web security.

One controls what the browser loads, the other controls how it connects.