LESSON 4.1
HTTPS, security headers, and CSP
Learn key techniques and workflows in Practical Web Security.
8m
intermediate
7,099 students
Overview
A handful of response headers remove entire attack classes. CSP is the strongest and the fiddliest, so roll it out in report-only first.
In this lesson you will:
- Enforce HTTPS and enable HSTS
- Set the headers that block framing and sniffing
- Introduce a content security policy incrementally
Pro Tip
Use caching and revalidation wisely to ensure your app stays fast and data remains fresh without unnecessary requests.