The slides here are part of my presentation at the Confraria0day meeting in March 2017. It is an introduction to the various HTTP security headers with some insights about them. It covers HSTS, HPKP, X-Frame-Options, Content Security Policy, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy and Set-Cookie options.

1. HTTP Security Headers
Ismael Gonçalves
Mar/2017
https://sharingsec.blogspot.com

2. Agenda
• Who I am
• HTTP Security Headers Introduction
• HTTP Strict Transport Security (HSTS)
• HTTP Public Key Pins (HPKP)
• X-Frame-Options
• X-XSS-Protection
• Content Security Policy (CSP)
• Set-Cookie Options
• X-Content-Type-Options
• Referrer-Policy
• Conclusion
• References

3. Who I am
• Sr Consultant at F5 Networks
• 10 years of work related to application security (coding, attacking,
defending)
• OWASP Contributor (former Brasília Chapter leader, Top Ten
Cheatsheet, OWASP Testing Guide)
• Practioner of responsible security vulnerability disclosure
• ISC2 volunteer – SME for CISSP exam development
• Independent research
• Blogger at http://sharingsec.blogspot.com (where there is time!)

4. HTTP Security Headers Introduction
• Security model evolution
• Channel communication protection
• Client-side Security
• Security policies enforced by the browser

5. HTTP Request/Response
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/57.0.2987.110 Mobile Safari/537.36
Host: www.exemplo.com
Accept: */*
HTTP/1.1 200 OK
Date: Fri, 17 Mar 2017 07:45:30 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Content-Length: 891
Content-Type: text/html

6. HTTP Request/Response
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/57.0.2987.110 Mobile Safari/537.36
Host: www.exemplo.com
Accept: */*
HTTP/1.1 200 OK
Date: Fri, 17 Mar 2017 07:45:30 GMT
Server: Apache/2.2.8 (Ubuntu) DAV/2
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Content-Length: 891
Content-Type: text/html
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload

7. HTTP Strict Transport Security (HSTS)
Strict-Transport-Security: max-age=<expire-time>
Strict-Transport-Security: max-age=<expire-time>; includeSubDomains
Strict-Transport-Security: max-age=<expire-time>; preload

8. Tipical HTTP to HTTPS transition
http://www.exemplo.com
GET / HTTP/1.0
Host: www.exemplo.com
301 Moved Permantenly
Content-Length: 0
Location: https://www.exemplo.com
https://www.exemplo.com
GET / HTTP/1.0
Host: www.exemplo.com

9. SSLStrip
GET https://www.exemplo.comGET http://www.exemplo.com
HTML ResponseModified HTLM response and
in clear text

10. HSTS Support
http://caniuse.com/#feat=stricttransportsecurity

11. HSTS – under the hood

12. HSTS – Observations
- Suitable for sites supporting entire content in HTTPS
- Implementation might be difficult due L7 routing
- Preload list always require subdomains
- Difficult to remove due browser updates
- Mitigate SSLStrip and potentially, SSLStri2 with preload + subdomains
- Protection against MITM with invalid certificates

13. HTTP Public Key Pins (HPKP)
Public-Key-Pins: pin-sha256=<base64==>; max-age=<expireTime>;
Public-Key-Pins: pin-sha256=<base64==>; max-age=<expireTime>;
includeSubDomains
Public-Key-Pins: pin-sha256=<base64==>; max-age=<expireTime>;
report-uri=<reportURI>

14. Valid response with HPKP headers
HTTP/1.1 200 OK
Server: GitHub.com
Status: 200 OK
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Public-Key-Pins: max-age=5184000; pin-
sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-
sha256="RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho="; pin-
sha256="k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws="; pin-
sha256="K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q="; pin-
sha256="IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4="; pin-
sha256="iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0="; pin-
sha256="LvRiGEjRqfzurezaWuj8Wie2gyHMrW5Q06LspMnox7A="; includeSubDomains
Vary: Accept-Encoding
X-Served-By: d41662224d8c44f09604b862e979767a
X-GitHub-Request-Id: B36F2320:987D:E88A2AC:5741D913

15. Public Key Pins Support
http://caniuse.com/#feat=publickeypinning

16. HTTP Public Key Pins - Observations
- It requires a good level of maturity
- report-only (Public-Key-Pins-Report-Only) mode?
- Does it mitigate MITM?
- Internal root CA?
- Chrome/Firefox support

17. Curiosities (HSTS, HPKP, Static Pinning)
- Static pinning (Chromium.org)
- https://cs.chromium.org/chromium/src/net/http/transport_security_state_st
atic.json
- Google, Facebook, Twitter, Dropbox, Yahoo, Tor
- +23k domains using HSTS pre-load

18. X-Frame-Options
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
X-Frame-Options: ALLOW-FROM https://example.com/

19. Clickjacking Attack
https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)

20. X-Frame-Options Support
http://caniuse.com/#feat=publickeypinning

21. X-Frame-Options - Observations
- Does the website needs to be open by another in a frame?
- It does not support more than one URL in allow-from
- CSP 2 frame-ancestor a good replacement
- It mitigates clickjacking

22. X-XSS-Protection
X-XSS-Protection: 0
X-XSS-Protection: 1
X-XSS-Protection: 1; mode=block

23. Cross-Site-Scritping (XSS) Attack

24. X-XSS-Protection Support
https://developer.mozilla.org/pt-BR/docs/Web/HTTP/Headers/X-XSS-Protection

25. X-XSS-Protection - Observations
- It offers protection against reflected XSS
- It is not supported by Firefox
- Issues with XSS filter

26. Content Security Policy (CSP)
Content-Security-Policy: <policy>; <policy>

27. Content Security Policy (CSP)
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

28. CSP header example
Resposta https://twitter.com/
Content-Security-Policy: script-src 'nonce-7tS2MKRWrGdmy1/R72jiDQ==' https://connect.facebook.net https://cm.g.doubleclick.net
https://ssl.google-analytics.com https://graph.facebook.com https://twitter.com 'unsafe-eval' https://*.twimg.com
https://api.twitter.com https://analytics.twitter.com https://publish.twitter.com https://ton.twitter.com
https://syndication.twitter.com https://www.google.com https://t.tellapart.com https://platform.twitter.com https://www.google-
analytics.com 'self'; frame-ancestors 'self'; font-src https://twitter.com https://*.twimg.com data: https://ton.twitter.com
https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; media-src https://twitter.com
https://*.twimg.com https://ton.twitter.com blob: 'self'; connect-src https://graph.facebook.com https://*.giphy.com
https://*.twimg.com https://api.twitter.com https://pay.twitter.com https://analytics.twitter.com https://*.twprobe.net
https://media.riffsy.com https://embed.periscope.tv https://upload.twitter.com 'self'; style-src https://fonts.googleapis.com
https://twitter.com https://*.twimg.com https://translate.googleapis.com https://ton.twitter.com 'unsafe-inline'
https://platform.twitter.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; object-src https://twitter.com
https://pbs.twimg.com; default-src 'self'; frame-src https://staticxx.facebook.com https://twitter.com https://*.twimg.com
https://5415703.fls.doubleclick.net https://player.vimeo.com https://pay.twitter.com https://www.facebook.com
https://ton.twitter.com https://syndication.twitter.com https://vine.co twitter: https://www.youtube.com
https://platform.twitter.com https://upload.twitter.com https://s-static.ak.facebook.com https://4337974.fls.doubleclick.net 'self'
https://donate.twitter.com; img-src https://graph.facebook.com https://*.giphy.com https://twitter.com https://*.twimg.com
https://ad.doubleclick.net data: https://lumiere-a.akamaihd.net https://fbcdn-profile-a.akamaihd.net https://www.facebook.com
https://ton.twitter.com https://*.fbcdn.net https://syndication.twitter.com https://media.riffsy.com https://www.google.com
https://stats.g.doubleclick.net https://api.mapbox.com https://www.google-analytics.com blob: 'self'; report-uri
https://twitter.com/i/csp_report?a=NVQWGYLXFVZXO2LGOQ%3D%3D%3D%3D%3D%3D&ro=false;
Set-Cookie: fm=0; Expires=Tue, 28 Mar 2017 11:35:01 UTC; Path=/; Domain=.twitter.com; Secure; HTTPOnly
Strict-Transport-Security: max-age=631138519
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

29. Content Security Policy (CSP) support
http://caniuse.com/#feat=contentsecuritypolicy2

30. Content Security Policy (CSP) - considerations
- Difficult to implement, removal of inline javascripts
<html>
<head>
<script>var msg = ‘javascript inline’; alert(msg);</script>
</head>
<body>Ola!</body></html>
- Unsafe-inline, Unsafe-eval could mine efforts
- Protection against XSS (Reflected/Stored), but definitive?
- Protection against clickjacking
- Not supported by all browsers

31. Set-Cookie (cookie options)
Set-Cookie: <key>=<value>; Expires=<expiryDate>; Secure; HttpOnly;
SameSite=<strict/lax>

32. Set-Cookie (cookie options)
HttpOnly – Cookie not accessible via Javascript
Secure – Prevents sending cookies in a clear text channel
SameSite – Prevents sending cookies in cross-site request (very useful
against CSRF)

33. CSRF

34. Set-Cookie (cookie options) - observations
- Secure and HttpOnly
- Protection against cookie hijacking in HTTP clear text traffic
- Reduces impact on a XSS attack – session hijacking
- SameSite – Only supported by Chrome
- Still in draft
- It supplies good protection against CSRF/XSSI
- Lax – used with HTTP “secure” methods
- Could it affect browsing in general?

35. X-Content-Type-Options
X-Content-Type-Options: nosniff;

36. X-Content-Type-Options - Observations
- Supported by all popular browsers but Safari
- It mitigates MIME Confusion attacks
- Server must return correct MIME type (Content-type)

37. Referrer-Policy
Referrer-Policy: <option>
Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origin
Referrer-Policy: origin-when-cross-origin
Referrer-Policy: same-origin
Referrer-Policy: strict-origin
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: unsafe-url

38. Referrer-Policy
Policy Document Navigation to Referrer
no-referrer https://example.com/page.html any domain or path no referrer
no-referrer-when-downgrade https://example.com/page.html https://example.com/otherpage.html https://example.com/page.html
no-referrer-when-downgrade https://example.com/page.html https://mozilla.org https://example.com/page.html
no-referrer-when-downgrade https://example.com/page.html http://example.org no referrer
origin https://example.com/page.html any domain or path https://example.com/
origin-when-cross-origin https://example.com/page.html https://example.com/otherpage.html https://example.com/page.html
origin-when-cross-origin https://example.com/page.html https://mozilla.org https://example.com/
origin-when-cross-origin https://example.com/page.html http://example.com/page.html https://example.com/
same-origin https://example.com/page.html https://example.com/otherpage.html https://example.com/page.html
same-origin https://example.com/page.html https://mozilla.org no referrer
strict-origin https://example.com/page.html https://mozilla.org https://example.com/
strict-origin https://example.com/page.html http://example.org no referrer
strict-origin http://example.com/page.html any domain or path http://example.com/
strict-origin-when-cross-origin https://example.com/page.html https://example.com/otherpage.html https://example.com/page.html
strict-origin-when-cross-origin https://example.com/page.html https://mozilla.org https://example.com/
strict-origin-when-cross-origin https://example.com/page.html http://example.org no referrer
unsafe-url https://example.com/page.html any domain or path https://example.com/page.html
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

39. Referrer-Policy Support
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

40. Referrer-Policy - observations
- Still under development
- Still limited support (Firefox and some options for Chrome)
- It treats privacy concerns
Referer: https://github.com/irgoncalves/jwtbf

41. Tools to investigate HTTP headers
https://observatory.mozilla.org/
https://securityheaders.io
https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#t
ab=Technical_Resources

42. Conclusions
- HTTP security headers could improve security and privacy of users
- Part of defense in depth strategy
- Some of them have pitfalls and require maturity
- They still need additional controls
- Different support level per browsers

43. References
- https://tools.ietf.org/html/rfc6797
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
- https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
- https://www.owasp.org/index.php/Clickjacking
- https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
- https://scotthelme.co.uk/
- https://www.wired.com/2016/03/https-adoption-google-report/
- http://www.html5rocks.com/en/tutorials/security/content-security-policy/
- https://www.bettercap.org/blog/sslstripping-and-hsts-bypass/
- https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/45542.pdf
- https://technet.microsoft.com/library/security/2524375
- https://csp.withgoogle.com/docs/index.html
- The Tagled Web - A Guide to Security Modern Web Applications, Michael Zalewski