Security Headers, TLS & Cookies

Hardening the transport and browser layer.

Video tutorialTrack course · freeCodeCamp

Ethical Hacking & Web Security Full Course

Speed

0.75x1x1.25x1.5x2x

Skip intro Next lesson

Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic

Transcript & captions .txt

7/7

1. 00:00Security Headers, TLS & Cookies. Hardening the transport and browser layer.
2. 00:05Reference table: Header, Purpose.
3. 00:10A reasonable starting CSP (js): Content-Security-Policy: default-src 'self';…
4. 00:15Serve everything over TLS 1.2+ and redirect HTTP to HTTPS.
5. 00:20Cookies: Secure, HttpOnly, SameSite, minimal scope and lifetime.
6. 00:25Disable weak ciphers and keep certificates renewed automatically.
7. 00:30Do not leak server versions in headers or error pages.

Content-Security-Policy: default-src 'self';
  script-src 'self';
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  frame-ancestors 'none';
  base-uri 'self';

• Serve everything over TLS 1.2+ and redirect HTTP to HTTPS.
• Cookies: Secure, HttpOnly, SameSite, minimal scope and lifetime.
• Disable weak ciphers and keep certificates renewed automatically.
• Do not leak server versions in headers or error pages.