Interview question
What security headers should a PHP application send and why? PHP application को कौन-से security headers भेजने चाहिए और क्यों?
Answer
| Header | Protects against |
|---|---|
| Content-Security-Policy | XSS by restricting script/resource sources |
| X-Frame-Options: DENY | Clickjacking (embedding site in an iframe) |
| X-Content-Type-Options: nosniff | MIME-sniffing attacks |
| Strict-Transport-Security | Forces HTTPS, prevents downgrade attacks |
| Referrer-Policy | Limits leaking sensitive URL info to third parties |
header("Content-Security-Policy: default-src 'self'");
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');| Header | किससे बचाता है |
|---|---|
| Content-Security-Policy | XSS से |
| X-Frame-Options: DENY | Clickjacking से |
| Strict-Transport-Security | HTTPS force करता है |
header("Content-Security-Policy: default-src 'self'");
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');Was this answer clear?