[hint] Security headers

[Malvoz]

Security headers to consider:

Cross-Origin-Embedder-Policy (COEP):

1. https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/mobilebasic#

---

Cross-Origin-Opener-Policy (COOP):

Prevents third-parties from opening/controlling a window.

Relates to rel="noopener" and CSP's disown-opener directive, I think.

The initially proposed name for this header was Cross-Origin-Isolate and later Cross-Origin-Window-Policy. In Safari 12 this was implemented and renamed from Cross-Origin-Options.

---

Cross-Origin-Resource-Policy (CORP):

Enables authors to prevent other domains from loading resources by restricting any kind of cross-origin load to protect themselves against Spectre attacks.

This header was originally named From-Origin. (Available in Safari 12).

IDK; check for interoperability with CSP and Access-Control-Allow-Origin?
Yep, and X-Frame-Options: whatwg/html#3740 (comment)

---

Expect-CT:

The Expect-CT header allows sites to opt in to reporting and/or enforcement of Certificate Transparency requirements, which prevents the use of misissued certificates for that site from going unnoticed. When a site enables the Expect-CT header, they are requesting that the browser check that any certificate for that site appears in public CT logs.

1. https://scotthelme.co.uk/a-new-security-header-expect-ct/
2. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT

---

Feature-Policy (+ Document-Policy):

The HTTP Feature-Policy header provides a mechanism to allow and deny the use of browser features in its own frame, and in iframes that it embeds.

---

+ Non-standard headers:

X-Download-Options:

When this header is set with the value noopen it prevents IE from displaying an "Open"-button after an HTML file is downloaded. This was introduced for IE 8 (support suggested for MS Edge) due to the fact that downloadeded HTML files that were opened directly would execute scripts in the context of the page.

1. https://www.nwebsec.com/HttpHeaders/SecurityHeaders/XDownloadOptions

---

X-Permitted-Cross-Domain-Policies:

This header specifies if/how a cross-domain policy-file (XML) is allowed. The file defines a policy to grant web clients, such as Adobe Flash Player or Adobe Acrobat (e.g. PDF files), permission to handle data across domains.

Considered a top-10 security header at OWASP.

Check for interoperability with Cross-Origin-Resource-Policy, CSP and Access-Control-Allow-Origin?

---

Also @molant mentioned CORB.