Security headers

A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Tell the browser what the pages may load and who may frame them, with a strict Content Security Policy and the headers around it.

Usually comes after: TLS & network policy.

Prompt for your AI assistant

Read the frontend decision record in docs/decisions if there is one and list every origin the pages load scripts, styles, images, fonts and connections from, including analytics and error reporting. Add a Content Security Policy that allows only those, with scripts allowed by hash or nonce rather than unsafe-inline, a tight img-src and frame-ancestors set to none or this site. Ship it as Content-Security-Policy-Report-Only first, walk through every page and the consent and sign-in flows, fix every violation and then enforce it. Add X-Content-Type-Options: nosniff, a Referrer-Policy of strict-origin-when-cross-origin and a Permissions-Policy that turns off every feature the product does not use. Publish /.well-known/security.txt with a contact and an expiry date. Add a post-deploy check that fetches a page and fails when any of these headers is missing.

This is https://gradus.kazet.blog/tree/cloud-application/step/security-headers as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.