Story of http headers

1. Story of Headers :
The First Layer of Security
Anupriya Srivastava
(53R3N1TY)

2. About 53r3n1ty
● Full-stack Blockchain
developer @
● Prev. Front-end
developer @
● Lifetime security enthusiast

3. Find me on
● twitter.com/_53R3N1TY
● hackerone.com/53r3n1ty
● github.com/53R3N1TY
● linkedin.com/in/anupriya-srivastava-336a0871/

4. Why security headers are
important ?
To secure your client’s DOM from malicious vectors.
OR
To start preventing your web apps from client side.

5. Like a patch burger
1. Application code
2. Application configuration
3. Web server configuration
4. Application firewall
5. Dependent hosts
6. Client-side security controls
7. Logging, monitoring & alerting
8. Deceptive defence

6. Analysing security vectors in
Single HTTP request

7. HTTP Response Anatomy

8. Status Codes : Allocated Text
Status-Code defines the class of response.
1xx : Informational
2xx : Success
3xx : Redirection
4xx : Client Error
5xx : Server Error

9. HTTP Response
● Header
● Body

10. HTTP Header
● Uses browsers security features
● First Layer of defence

11. Header’s Coverage
1. HSTS
2. CSP
3. X-XSS-Protection
4. SOP & CORS
5. X-Frame-Option
6. HTTP Key Pinning
7. Referrer Policy
8. Feature Policy

12. HTTP Secure Transport Policy
(HSTS)
● Strict-Transport-Security:
○ max-age=<expire-time>
○ includeSubDomain(problems)
○ Preload
● Drawback:
○ If subdomain included then your internal apps also
won’t support HTTP

13. Content Security Policy
(CSP)
Content-Security-Policy:
default-src 'self';
script-src (x-xss-protection) 'unsafe-inline' 'strict-dynamic' http: https: 'sha256-
uxzi2OgpNXaSA/8wT6X4JDqw8Y+ODCxCwB+WsuWagBY=' ;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ https://platform.twitter.com
https://*.twimg.com https://*.disquscdn.com;
img-src 'self' data: https://www.google-analytics.com/ https://syndication.twitter.com
https://*.twimg.com;
frame-src https://platform.twitter.com https://disqus.com/ https://player.vimeo.com
https://www.youtube.com;
object-src 'self';
font-src 'self' https://fonts.gstatic.com;
connect-src https://links.services.disqus.com;
report-uri https://websec.report-uri.io/r/default/csp/enforce

14. “IF CSP applied then this isn’t required.
Otherwise X-XSS-Protection gives exception on
inline scripts.”
● X-XSS-Protection: 0
● X-XSS-Protection: 1
● X-XSS-Protection: 1; mode=block
● X-XSS-Protection: 1; report=<reporting-uri>
X-XSS-Protection
SOP & CORS

15. X-Frame-Option
X-Frame-Options: deny
X-Frame-Options: sameorigin
X-Frame-Options: allow-from https://example.com/
The X-Frame-Options HTTP response header can be used to indicate whether
or not a browser should be allowed to render a page in a <frame>, <iframe>,
<embed>or <object> . Sites can use this to avoid clickjacking attacks, by
ensuring that their content is not embedded into other sites.

16. HTTP Key Pinning
● Public-Key-Pins:
○ pin-sha256="base64+primary==";
○ pin-sha256="base64+backup==";
○ max-age=5184000;
○ includeSubDomains
○ Always;
● Drawback:
○ Likely to be deprecated.
○ If a hacker gets the access of your
webapp, deployed his own certs and asks
ransom?

17. Referrer Policy
● Referrer Policy:
○ ""
○ "No-referrer"
○ "No-referrer-when-downgrade"
○ "Same-origin"
○ "Origin"
○ "Strict-origin"
○ "Origin-when-cross-origin"
○ "Strict-origin-when-cross-origin"
○ "unsafe-url”

18. Feature Policy
● Feature-Policy: <directive> <allowlist>
● Directives:
○ Autoplay
○ Camera
○ Fullscreen
○ Geolocation
○ Musical instrument digital interface(MIDI)
○ Microphone
○ Payment
○ VR ...
● Allowlist:
○ ‘*’
○ ‘self’
○ ‘Src’
○ ‘None’
○ ‘origin(s)’

19. Body
● Custom code
● Custom security features

20. Evolution: 5 Years ago
Web Layer
Business Logic
Data Instance

21. Evolution:
Web Layer
Business Logic
Data Instance
Client Logic
Web | Hybrid Apps

22. Javascript
XSS-cross site scripting
CSRF-cross site request forgery
SSTI-server side template injection
SQLI-SQL Injection
Major p1,p2 bounty is because of
deprecated javascript code or
unauthorized code

23. Cookies?
● Directives
○ Secure : Only go through TLS
○ HttpOnly : Document.cookie can’t access it (xss-protection)
○ SameSite : only available for origin domain(csrf-protection)
● Prefix:
○ __Secure- : TLS required
○ __Host- : TLS + ‘/’ path required

24. Recap?
● Header?
● Body?
● Cookie?
● HTTP Request-Response Cycle

25. Toolings
Header vulnerability
https://securityheaders.com
Javascript Parser
https://github.com/nahamsec/JSParser

26. Don’t Ignore
Security
Conclusion?

27. @53r3n1ty
Anupriya
Srivastava

28. Thank
you