implement-http-security-headers
Implement HTTP security headers from an application threat model, route inventory, browser behavior, and staged enforcement evidence. Use when hardening a website or web application against framing, type confusion, leakage, downgrade, or unsafe browser capabilities.
ソース情報
- リポジトリ
- protosphinx/sphinxstack
- ソースの最終更新活動
- 2026年7月29日 13:55
- 検出された SKILL.md の言語
- 英語
- スター
- 3
- フォーク
- 0
インストール方法
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
ソースファイルを確認
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
ファイルエクスプローラー
2 ファイルSKILL.md を表示中
SKILL.md
ソースの指示 · 読み取り専用プレビュー- name
- implement-http-security-headers
- category
- web
- description
- Implement HTTP security headers from an application threat model, route inventory, browser behavior, and staged enforcement evidence. Use when hardening a website or web application against framing, type confusion, leakage, downgrade, or unsafe browser capabilities.
# implement-http-security-headers
Apply headers at the response layer that owns each route and content type.
## When to use
- Use for production web applications, static sites, APIs serving browsers, and embedded content.
- Do not copy a generic header set without testing required integrations and route behavior.
## Procedure
1. Inventory origins, routes, content types, frames, scripts, styles, media, downloads, cross-origin calls, and browser capabilities.
2. Define threats and compatibility needs for transport, framing, MIME handling, referrers, permissions, isolation, and cross-origin resources.
3. Configure HSTS only after HTTPS coverage, subdomain ownership, redirects, certificate operations, and recovery are proven.
4. Set content-type, frame, referrer, permissions, and cross-origin policies at the narrowest correct scope.
5. Coordinate framing rules with Content Security Policy and explicitly authorized embedders.
6. Stage report-only or monitoring where available and classify violations by route, browser, dependency, and user impact.
7. Test authenticated, anonymous, download, error, redirect, API, embed, and legacy-browser responses.
8. Roll out by environment and route, monitor, document exceptions with expiry, and verify at the public edge.
## Done
- A security-header control matrix records threat, route, value, owner, exception, browser support, rollout, and recovery
- Automated response, browser journey, embed, download, edge, and regression tests verify enforced headers without breaking required behavior
GitHubで見る