Nov 18, 2025, 11:53:13 AM
Nicolas Jouanne
Nicolas Jouanne
Security Headers List
Table of Contents
- List of Security Headers
- Glossary
- Useful Information
List of Security Headers
The OWASP configuration is detailed in the following two chapters [“List of page-type headers” and “List of REST API-type headers.” For each header, it is specified which configuration has been applied to Lutèce. If the OWASP recommendation has not been followed (header omitted or different values chosen), reasons are provided to explain why.
The following icons indicate the choice made for Lutèce regarding the addition of a header proposed by OWASP:
- :white_check_mark: The proposed header has been added, and the chosen values are those recommended
- :warning: The proposed header has been added, but the chosen values are different from those recommended
- :x: The proposed header has not been added
List of Page-Type Headers
This list constitutes all the [“active” headers that OWASP recommends adding to responses when the server returns a page.
Strict-Transport-Security :white_check_mark:
| Definition | Informs browsers that the site should only be accessible via HTTPS and that future access attempts via HTTP will be automatically switched to HTTPS. This helps prevent protocol downgrade attacks and cookie hijacking. |
|---|---|
| Value recommended by OWASP | max-age=31536000; includeSubDomains |
| Value retained for Lutèce | max-age=31536000; includeSubDomains |
| Page category | all pages |
| Remarks | - The recommended values mean that this behavior will apply for 31536000 seconds (1 year) from the first response provided to the client by the server and that it also applies to subdomains (see the glossary at the bottom of the page for the definition of a subdomain). \ - This header only concerns sites that use the HTTPS protocol. \ - It is ignored if client/server exchanges use the HTTP protocol. |
| Compatibility with desktop browsers | Chrome 4+, Edge 12+, Firefox 4+, Opera 12+, Safari 7+ |
| Compatibility with mobile browsers | Chrome Android 18+, Firefox for Android 4+, Opera Android 12+, Safari on iOS 7+, Samsung Internet 1.0+, WebView Android 4.4+ |
X-Frame-Options :x:
| Definition | Specifies whether the browser is allowed to display a page in a , |
|---|---|
| Value recommended by OWASP | deny |
| Value retained for Lutèce | no value as header not retained |
| Page category | no category as header not retained |
| Remarks | - The OWASP recommendation was not followed because this header has been made obsolete by the frame-ancestors directive present in the Content-Security-Policy header. |
| Compatibility with desktop browsers | Chrome 4+, Edge 12+, Firefox 4+, Opera 10.5+, Safari 4+ |
| Compatibility with mobile browsers | Chrome Android 18+, Firefox for Android 4+, Opera Android 12+, Safari on iOS 7+, Samsung Internet 1.0+, WebView Android 4.4+ |
X-Content-Type-Options :white_check_mark:
| Definition | Indicates to the browser not to try to guess the MIME type of a resource and to rely on the content of the Content-Type header of the request. |
|---|---|
| Value recommended by OWASP | nosniff |
| Value retained for Lutèce | nosniff |
| Page category | all pages |
| Remarks | - The only possible value for this header is nosniff. |
| Compatibility with desktop browsers | Chrome 64+, Edge 12+, Firefox 50+, Opera 51+, Safari 11+ |
| Compatibility with mobile browsers | Chrome Android 64+, Firefox for Android 50+, Opera Android 47+, Safari on iOS 11+, Samsung Internet 9.0+, WebView Android 64+ |
Content-Security-Policy (CSP) :warning:
| Definition | Defines a security layer to detect or mitigate certain types of attacks, including XSS and data injection attacks. |
|---|---|
| Value recommended by OWASP | default-src ‘self’; form-action ‘self’; object-src ‘none’; frame-ancestors ‘none’; upgrade-insecure-requests; block-all-mixed-content |
| Value retained for Lutèce | default-src ‘self’; script-src ‘self’ ‘unsafe-inline’; style-src ‘self’ ‘unsafe-inline’; img-src ‘self’ data: blob:; connect-src ‘self’ blob:; object-src ‘none’; frame-ancestors ‘self’; upgrade-insecure-requests |
| Page category | all pages |
| Remarks | - The configuration chosen for Lutèce takes into account the constraints imposed by the existing code as well as by certain third-party libraries such as tinyMCE, for example. Its editor requires a specific configuration to be applied when a CSP header is defined to continue using this library (see TinyMCE Security Documentation). \ - An incorrect configuration of this header can seriously compromise the functioning of an application. \ - The configuration of this header is described in detail in the following table. |
| Compatibility with desktop browsers | Chrome 25+, Edge 14+, Firefox 23+, Opera 15+, Safari 7+ |
| Compatibility with mobile browsers | Chrome Android 25+, Firefox for Android 23+, Opera Android 14+, Safari on iOS 7+, Samsung Internet 1.5+, WebView Android 4.4+ |
Detail of the Content-Security-Policy Header Configuration
The table below details each of the directives recommended by OWASP for the Content-Security-Policy header. A directive can be followed by 0, 1, or more values. The list of directives is available at the following address: Content-Security-Policy.com. The meaning of the icons is the same as for the headers but applied to the directives.
| Directive Name | Value recommended by OWASP | Value retained for Lutèce | Remarks | Compatibility with desktop browsers | Compatibility with mobile browsers |
|---|---|---|---|---|---|
| default-src :white_check_mark: | ‘self’ | ‘self’ | - Sets the defined value (default value) for all *-src directives such as script-src or img-src, for example. \ - The value ‘self’ means that access to resources is only allowed if the caller has the same origin as the requested resource (see the glossary for the definition of origin). \ - If a -src directive is defined in CSP, its value replaces the default value. \ - The value proposed by the tinyMCE library editor for this directive is ‘none’, which is too restrictive for Lutèce as some pages would no longer work. The proposal made by OWASP has therefore been retained. | Chrome 25+, Edge 14+, Firefox 23+, Opera 15+, Safari 7+ | Chrome Android 25+, Firefox for Android 23+, Opera Android 14+, Safari on iOS 7+, Samsung Internet 1.5+, WebView Android 4.4+ |
| script-src :warning: | ‘self’ (value set by default-src) | ‘self’ ‘unsafe-inline’ | - Defines valid sources for loading and executing JavaScript scripts. \ - It is not possible to apply the configuration proposed by OWASP because the value ‘self’ implies that inline JavaScript scripts, function calls via events (such as OnClick), and scripts called via an tag would no longer work. \ - The combination of values ‘self’ ‘unsafe-inline’ still enhances security (especially regarding attacks using jQuery) without changing the existing code. | Chrome 25+, Edge 14+, Firefox 23+, Opera 15+, Safari 7+ | Chrome Android 25+, Firefox for Android 23+, Opera Android 14+, Safari on iOS 7+, Samsung Internet 1.5+, WebView Android 4.4+ |
| style-src :warning: | ‘self’ (value set by default-src) | ‘self’ ‘unsafe-inline’ | - Defines valid sources for loading and executing styles and CSS stylesheets. \ - It is not possible to apply the configuration proposed by OWASP because there are inline style tags and div tags with a style attribute in the code. These would no longer work if the proposed configuration were applied. \ - Just like the script-src sub-directive, the combination of ‘self’ and ‘unsafe-inline’ values still enhances security without touching the code. | Chrome 25+, Edge 14+, Firefox 23+, Opera 15+, Safari 7+ | Chrome Android 25+, Firefox for Android 23+, Opera Android 14+, Safari on iOS 7+, Samsung Internet 1.5+, WebView Android 4.4+ |
| img-src :warning: | ‘self’ (value set by default-src) | ‘self’ data: blob: | - Defines valid sources for loading images. \ - Adding the values data: and blob: to the ‘self’ value serves to allow data URLs (e.g., base64 images) and blob URLs as content sources for images. This addition is required by the tinyMCE library, which necessitates the addition of these two values in addition to the ‘self’ value. | Chrome 25+, Edge 14+, Firefox 23+, Opera 15+, Safari 7+ | Chrome Android 25+, Firefox for Android 23+, Opera Android 14+, Safari on iOS 7+, Samsung Internet 1.5+, WebView Android 4.4+ |
| connect-src :warning: | ‘self’ (value set by default-src) | ‘self’ blob: | - Restricts the URLs that can be loaded using script interfaces. This includes XMLHttpRequest (XHR / AJAX), WebSocket, fetch(), , EventSource, and Navigator.sendBeacon(). \ - Adding the value blob: to the ‘self’ value serves to allow blob URLs as content sources by script interfaces. This addition is required by the tinyMCE library, which necessitates the addition of this value in addition to the ‘self’ value. | Chrome 25+, Edge 14+, Firefox 23+, Opera 15+, Safari 7+ | Chrome Android 25+, Firefox for Android 50+, Opera Android 14+, Safari on iOS 7+, Samsung Internet 1.5+, WebView Android 4.4+ |
| object-src :white_check_mark: | ‘none’ | ‘none’ | - Specifies valid sources for | Chrome 25+, Edge 14+, Firefox 23+, Opera 15+, Safari 7+ | Chrome Android 25+, Firefox for Android 23+, Opera Android 14+, Safari on iOS 7+, Samsung Internet 1.5+, WebView Android 4.4+ |
| frame-ancestors :warning: | ‘none’ | ‘self’ | - Specifies valid parents that a page can embed using , |