What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
What are the Important fields in HTTP header from security perspective?
When it comes to security, the safest response is to consider everything while placing priority on the things which attackers are known to exploit.
The headers which your server returns on a request are important to attackers (particularly fields which expose the software/version information about your webserver or otherwise allow the attacker to profile the server). (... and +1 for John Conde's mod_header directives on this point - definitely doesn't hurt to tell client browsers to enforce CSRF/XSS policies)
The headers which your webserver and application accept with a request (i.e. anything that your webserver or application has to parse) are important to you because (a) your webserver will probably make an effort to parse all of them - which may provide the attacker a means for executing a buffer overflow or slowloris attack - and (b) your application needs to sanitize and/or validate (as in the case of a cookie which may have been modified) anything used as an input.
Here's some I use:
https://developer.mozilla.org/en/the_x-frame-options_response_header https://wiki.mozilla.org/Security/CSP/Specification http://www.google.com/support/forum/p/Web%20Search/thread?tid=187e02e745a50a77&hl=en