Which security headers does amaise use?
All responses from amaise include comprehensive security headers:
Header | Value | Purpose |
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | Enforces HTTPS for 1 year, including subdomains |
Content-Security-Policy | default-src 'none'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'self' | Prevents XSS, data injection, clickjacking |
X-Content-Type-Options | nosniff | Prevents MIME type sniffing |
Referrer-Policy | same-origin | No referrer sent to external sites |
Permissions-Policy | Denies: camera, microphone, geolocation, payment, USB, etc. | Disables unnecessary browser APIs |
CORS policy: Explicit origin allowlist (no wildcards), credentials only with named origins, restricted HTTP methods and headers.