What are HTTP security headers?

Short answer

HTTP security headers are the headers that the server sends with the response and that limit client-side attacks by telling the browser how to interpret and run the content: Content-Security-Policy determines which resources can be loaded, X-Frame-Options whether the page can be shown inside an iframe, Strict-Transport-Security (HSTS) that the site is connected to only over HTTPS, X-Content-Type-Options MIME sniffing, and Referrer-Policy how much of the Referer information is shared. In TR7, these headers are selected from the Response Headers list of the Manage HTTP Security Headers action, and each of them is added with a fixed value to the responses coming from the Backend Service; the Remove Server Fingerprints(Server, X-Powered-By etc.) option in the same list removes the headers that give server information. HSTS can also be given with the HSTS (Strict-Transport-Security header) option in the TLS Security Profile, with an adjustable duration.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Actions (Policy Actions) → Manage HTTP Security Headers form	Response Headers	Selecting the headers to add or the server information cleanup
Load Balancer → Load Balancer vService List → HTTP vService form	Actions	Binding the action to the vService
Certificates & PKI → TLS Security Profiles → profile form → Frontend-only Settings	HSTS (Strict-Transport-Security header) (off by default), HSTS Duration (max-age) (default 180 days)	Giving HSTS through the profile, with the duration selected

Response Headers Options

The options in the Response Headers list and the values written to the response:

Option (interface label)	Written to the response	Risk it limits
Content-Security-Policy ("default-src 'self'" )	Content-Security-Policy: default-src 'self';	XSS and content injection (What is Content-Security-Policy (CSP)?)
Strict-Transport-Security (HSTS) ( "max-age=16000000; includeSubDomains; preload; ")	max-age=16000000; includeSubDomains; preload; (only on TLS connections)	Being downgraded to an unencrypted connection (What is HSTS?)
X-Frame-Options ("SAMEORIGIN")	X-Frame-Options: SAMEORIGIN	Clickjacking (What is X-Frame-Options?)
X-XSS-Protection ("1; mode=block")	X-XSS-Protection: 1; mode=block	Turning on the built-in XSS filter of older browsers
X-Content-Type-Options ("nosniff")	X-Content-Type-Options: nosniff	MIME sniffing (What is X-Content-Type-Options: nosniff?)
Referrer-Policy (no-referrer-when-downgrade)	Referrer-Policy: no-referrer-when-downgrade	Referer leakage on the switch from HTTPS to HTTP (What are the Referer header and Referrer-Policy?)
Permissions-Policy ( interest-cohort=(); )	Only the interest-cohort=(); policy; it does not restrict browser permissions such as location, camera or microphone	-
Remove Server Fingerprints(Server, X-Powered-By etc.)	Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version are deleted	Exposure of the server software and its version

The values are fixed; if a different value is needed, the header is written at the response stage with the Set HTTP Header action. The action is applied only to the responses coming from the Backend Service; the responses that TR7 produces itself (blocking and error pages, redirects) do not get these headers. Steps for applying them: Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend? · How do I hide headers that reveal server information, such as Server and X-Powered-By?

Common Misconceptions

• "Security headers protect the server." They protect the user in the browser; for the attacks coming to the server, a WAF is needed.
• "Turning on all the options together is risk-free." In particular, default-src 'self' can block content coming from an external CDN, an analytics service or an inline script; the options are first tried in a test environment.
• "If the Backend Service already sends the same header, no duplicate header is created." Content-Security-Policy, Strict-Transport-Security, X-Frame-Options and Referrer-Policy are written in place of the Backend Service's value; X-XSS-Protection and X-Content-Type-Options, on the other hand, are added next to the existing header (overwriting the existing headers).
• "If HSTS is on both in the action and in the TLS Security Profile, two headers are sent." If HSTS is selected in the action, its value is the one that applies; the profile setting is not applied.

How it is done in the documentation

• Manage HTTP Security Headers · The Security Headers That Can Be Selected
• Manage HTTP Security Headers · Overwriting the Existing Headers
• TLS Security Profiles · HSTS (Strict-Transport-Security header)

Related questions

• Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?
• How do I hide headers that reveal server information, such as Server and X-Powered-By?
• What is Content-Security-Policy (CSP)?
• What is HSTS?