鎻愰珮瀹夊叏鎬ц€屽湪HTTP鍝嶅簲澶翠腑鍙互浣跨敤鐨勫悇绉嶅搷搴斿ご瀛楁
Posted
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了鎻愰珮瀹夊叏鎬ц€屽湪HTTP鍝嶅簲澶翠腑鍙互浣跨敤鐨勫悇绉嶅搷搴斿ご瀛楁相关的知识，希望对你有一定的参考价值。
鏍囩锛?a href='http://www.mamicode.com/so/1/xss%e8%bf%87%e6%bb%a4' title='xss杩囨护'>xss杩囨护 origin des http 鍏朵粬 瀹炰綋 鐩存帴 鏈嶅姟
鏈枃浠嬬粛鍦╓eb鏈嶅姟鍣ㄥ仛鍑哄搷搴旀椂锛屼负浜嗘彁楂樺畨鍏ㄦ€ц€屽湪HTTP鍝嶅簲澶翠腑鍙互浣跨敤鐨勫悇绉嶅搷搴斿ご瀛楁銆傜敱浜庨儴鍒嗘祻瑙堝櫒涓湁鍙兘瀵规煇浜涘瓧娈垫垨閫夐」涓嶆彁渚涙敮鎸侊紝鎵€浠ュ湪浣跨敤杩欎簺瀛楁鏃惰鍏堢‘璁ゅ鎴风鐜銆?/p>
X-Frame-Options
璇ュ搷搴斿ご涓敤浜庢帶鍒舵槸鍚﹀湪娴忚鍣ㄤ腑鏄剧ずframe鎴杋frame涓寚瀹氱殑椤甸潰锛屼富瑕佺敤鏉ラ槻姝lickjacking锛堢偣鍑诲姭鎸侊級鏀诲嚮銆?/p>
X-Frame-Options: SAMEORIGIN
- DENY 绂佹鏄剧ずframe鍐呯殑椤甸潰锛堝嵆浣挎槸鍚屼竴缃戠珯鍐呯殑椤甸潰锛?/li>
- SAMEORIGIN 鍏佽鍦╢rame鍐呮樉绀烘潵鑷悓涓€缃戠珯鐨勯〉闈紝绂佹鏄剧ず鏉ヨ嚜鍏朵粬缃戠珯鐨勯〉闈?/li>
- ALLOW-FROM origin_uri鍏佽鍦╢rame鍐呮樉绀烘潵鑷寚瀹歶ri鐨勯〉闈紙褰撳厑璁告樉绀烘潵鑷簬鎸囧畾缃戠珯鐨勯〉闈㈡椂浣跨敤锛?/li>
X-Content-Type-Options
濡傛灉浠巗cript鎴杝tylesheet璇诲叆鐨勬枃浠剁殑MIME绫诲瀷涓庢寚瀹歁IME绫诲瀷涓嶅尮閰嶏紝涓嶅厑璁歌鍙栬鏂囦欢銆傜敤浜庨槻姝SS绛夎法绔欒剼鏈敾鍑汇€?/p>
X-Frame-Options: nosniff
X-XSS-Protection
鐢ㄤ簬鍚敤娴忚鍣ㄧ殑XSS杩囨护鍔熻兘锛屼互闃叉XSS璺ㄧ珯鑴氭湰鏀诲嚮銆?/p>
X-XSS-Protection: 1; mode=block
- 0 绂佺敤XSS杩囨护鍔熻兘
- 1 鍚敤XSS杩囨护鍔熻兘
Content-Security-Policy
鐢ㄤ簬鎺у埗褰撳閮ㄨ祫婧愪笉鍙俊璧栨椂涓嶈璇诲彇銆傜敤浜庨槻姝SS璺ㄧ珯鑴氭湰鏀诲嚮鎴栨暟鎹敞鍏ユ敾鍑伙紙浣嗘槸锛屽鏋滆瀹氫笉褰擄紝鍒欑綉绔欎腑鐨勯儴鍒嗚剼鏈唬鐮佹湁鍙兘澶辨晥)銆?/p>
涔嬪墠鐨勫瓧娈靛悕涓篨-Content-Security-Policy
Content-Security-Policy: default-src 鈥榮elf鈥?/pre>
- default-src 鈥榮elf鈥?nbsp;鍏佽璇诲彇鏉ヨ嚜浜庡悓婧愶紙鍩熷悕+涓绘満+绔彛鍙凤級鐨勬墍鏈夊唴瀹?/li>
- default-src 鈥榮elf鈥?*.example.com鍏佽璇诲彇鏉ヨ嚜浜庢寚瀹氬煙鍚嶅強鍏舵墍鏈夊瓙鍩熷悕鐨勬墍鏈夊唴瀹?/li>
X-Permitted-Cross-Domain-Policies
鐢ㄤ簬鎸囧畾褰撲笉鑳藉皢“crossdomain.xml”鏂囦欢锛堝綋闇€瑕佷粠鍒殑鍩熷悕涓殑鏌愪釜鏂囦欢涓鍙朏lash鍐呭鏃剁敤浜庤繘琛屽繀瑕佽缃殑绛栫暐鏂囦欢锛夋斁缃湪缃戠珯鏍圭洰褰曠瓑鍦哄悎鏃堕噰鍙栫殑鏇夸唬绛栫暐銆?/p>
X-Permitted-Cross-Domain-Policies: master-only
- master-only 鍙厑璁镐娇鐢ㄤ富绛栫暐鏂囦欢锛?crossdomain.xml锛?/li>
Strict-Transport-Security
鐢ㄤ簬閫氱煡娴忚鍣ㄥ彧鑳戒娇鐢℉TTPS鍗忚璁块棶缃戠珯銆傜敤浜庡皢HTTP缃戠珯閲嶅畾鍚戝埌HTTPS缃戠珯銆?/p>
Strict-Transport-Security: max-age=31536000; includeSubDomains
- max-age 鐢ㄤ簬淇敼STS鐨勯粯璁ゆ湁鏁堟椂闂淬€?/li>
- includeSubDomains 鐢ㄤ簬鎸囧畾鎵€鏈夊瓙鍩熷悕鍚屾牱浣跨敤璇ョ瓥鐣ャ€?/li>
Access-Control-Allow-Origin绛塁ORS鐩稿叧瀛楁
褰撲娇鐢╔MLHttpRequest浠庡叾浠栧煙鍚嶄腑鑾峰彇璧勬簮杩涜璺ㄥ煙閫氫俊鏃朵娇鐢ㄣ€?/p>
Access-Control-Allow-Origin: http://www.example.com Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: X-TRICORDER Access-Control-Max-Age: 1728000
涓婅堪浠ｇ爜鐢ㄤ簬璁惧畾涓?ldquo;http://www.example.com”杩涜璺ㄥ煙閫氫俊澶勭悊锛屽厑璁镐娇鐢≒OST, GET, OPTIONS鏂规硶锛屽湪鍙戦€佺殑璇锋眰澶翠腑娣诲姞X-TRICORDER瀛楁锛岄€氫俊瓒呮椂鏃堕棿涓?,728,00绉掋€?/p>
X-Download-Options
鐢ㄤ簬鏀剧疆鐩存帴鎵撳紑鐢ㄦ埛涓嬭浇鏂囦欢銆?/p>
X-Download-Options: noopen
- noopen 鐢ㄤ簬鎸囧畾IE 8浠ヤ笂鐗堟湰鐨勭敤鎴蜂笉鎵撳紑鏂囦欢鑰岀洿鎺ヤ繚瀛樻枃浠躲€傚湪涓嬭浇瀵硅瘽妗嗕腑涓嶆樉绀?ldquo;鎵撳紑”閫夐」銆?/li>
Set-Cookie
鐢ㄤ簬璁剧疆Cookie銆?/p>
Set-Cookie: name=value; secure; HttpOnly
- secure 鍙湪杩涜HTTP閫氫俊鏃跺彂閫丆ookie銆?/li>
- HttpOnly 鎸囧畾涓嶈兘浠嶫avaScript鑴氭湰浠ｇ爜璁块棶Cookie鍊笺€?/li>
- 铏界劧path灞炴€х敤浜庢寚瀹欳ooki鍙戦€佽矾寰勶紝浣嗘槸涓嶈兘琚綔涓轰竴绉嶅畨鍏ㄦ墜娈点€?/li>
- domain灞炴€у叿鏈夊悗鏂逛竴鑷寸壒鎬э紝鍑轰簬瀹夊叏鑰冭檻鏈€濂戒笉瑕佷娇鐢ㄨ灞炴€э紝闄ら潪鏄庣‘鎸囧畾鍚戝涓煙鍙戦€丆ookie銆?/li>
Cache-Control
鎸囧畾娴忚鍣ㄧ殑缂撳瓨鏂瑰紡锛岄€氳繃閫楀彿鍒嗛殧銆?/p>
Cache-Control: no-cache, no-store, must-revalidate
- no-cache 鎸囧畾鏈嶅姟鍣ㄧ涓嶇紦瀛樻暟鎹€?/li>
- no-store 鎸囧畾涓嶈兘鍦ㄦ湰鍦扮紦瀛樹腑淇濆瓨鏁版嵁銆?/li>
- must-revalidate 鎸囧畾鏈嶅姟鍣ㄧ鍙互缂撳瓨鏁版嵁锛屼絾鏄繀椤诲鏁版嵁杩涜纭銆?/li>
pragma
鐢ㄤ簬涓嶩TTP/1.0杩涜鍚戝悗鍏煎鐨勫搷搴斿ご瀛楁锛屽師鏈彧琚娇鐢ㄥ湪瀹㈡埛绔姹傚ご涓€備笌“Cache-Control: no-cache”缁撳悎浣跨敤銆?/p>
pragma: no-cache
- no-cache 瀹㈡埛绔姹傛墍鏈変腑闂存湇鍔″櫒涓嶈兘缂撳瓨鏁版嵁銆?/li>
expires
鎸囧畾鏁版嵁鐨勬湁鏁堟椂闂淬€備笉甯屾湜缂撳瓨鏁版嵁鏃跺彲浠ュ皢璇ュ瓧娈靛€间笌Date瀛楁鍊兼寚瀹氫负鐩稿悓鍊兼垨鑰呭皢璇ュ瓧娈靛€兼寚瀹氫负“-1”銆?/p>
expires: -1
content-type
鎸囧畾瀹炰綋鍐呭璞＄殑濯掍綋绫诲瀷锛圡ediaType锛夈€傚湪charset鍏抽敭瀛椾腑鎸囧畾鏂囧瓧缂栫爜鏍煎紡銆?/p>
content-type: text/html;charset=utf-8
HTTP鍝嶅簲澶寸殑璁惧畾鏂规硶
鍦ˋpache鏈嶅姟鍣ㄤ腑鎸囧畾鍝嶅簲澶存椂锛岄渶瑕佸湪httpd.conf鏂囦欢涓皢涓嬭堪妯″潡璁惧畾涓烘湁鏁堢姸鎬併€?/p>
- LoadModule headers_module modules/mod_headers.so
鐒跺悗浣跨敤涓嬭堪鏂规硶璁惧畾HTTP鍝嶅簲澶淬€?/p>
Header set HeaderFieldName "value" //渚嬪 Header set X-XSS-Protection "1; mode=block”
鏈枃杞嚜锛?a title="https://www.cnblogs.com/sunshq/p/4478488.html" href="https://www.cnblogs.com/sunshq/p/4478488.html" target="_blank">https://www.cnblogs.com/sunshq/p/4478488.html
以上是关于鎻愰珮瀹夊叏鎬ц€屽湪HTTP鍝嶅簲澶翠腑鍙互浣跨敤鐨勫悇绉嶅搷搴斿ご瀛楁的主要内容，如果未能解决你的问题，请参考以下文章
銆愰珮鎬ц兘缃戠珯鎼缓-learn-web-vitals缈昏瘧銆戔€斺€擶eb Vitals