Some notes on security
Take the time to think first about your personal security requirements before running it!
The following HTTP headers are always sent to avoid security/privacy problems (see also configuration parameter http_headers):
X-Content-Type-Options: nosniff |
Switch off MIME-type guessing in MS IE 8+ |
X-XSS-Protection: 1; mode=block |
Enable Cross-Site Scripting Protection for MS IE |
Content-Security-Policy: default-src 'self';script-src 'none' |
Content Security Policy |
X-DNS-Prefetch-Control: off |
Switch off DNS prefetching |
Strict-Transport-Security: max-age=15768000 ; includeSubDomains |
Enforce use of HTTPS at browser-side, but only sent when application was accessed via HTTPS link before (see RFC 6797) |
X-Frame-Options: DENY |
Deny use of frames completely to avoid click-jacking (see The X-Frame-Options response header) |