Security Headers Checker / Headers / Servers and panels

Security headers on HAProxy

A baseline set of security headers for HAProxy: HSTS, a Content-Security-Policy in Report-Only mode to start, framing protection, nosniff, a private Referrer-Policy, a Permissions-Policy and the cross-origin headers. Check what each can break below before you deploy, then scan your site to confirm.

The headers

# frontend (or backend) section, HAProxy 2.x
http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains"
http-response set-header Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests"
http-response set-header X-Frame-Options "SAMEORIGIN"
http-response set-header X-Content-Type-Options "nosniff"
http-response set-header Referrer-Policy "strict-origin-when-cross-origin"
http-response set-header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()"
http-response set-header Cross-Origin-Opener-Policy "same-origin-allow-popups"
http-response set-header Cross-Origin-Resource-Policy "same-site"

Will this break anything?

• Strict-Transport-Security: once a browser has seen it, it refuses plain HTTP for this host for max-age seconds (and with includeSubDomains for every subdomain: mail, staging, old tools). Check they all serve HTTPS, start with max-age=300, then raise it. preload is very hard to undo.
• Content-Security-Policy-Report-Only blocks nothing: browsers only report what an enforced policy would block, so it is safe to add first and watch.
• X-Frame-Options: DENY stops every site from framing yours, including your own other domains, booking or payment widgets that frame your pages, and page-builder previews. SAMEORIGIN allows your own origin.
• X-Content-Type-Options: browsers refuse scripts and stylesheets served with the wrong Content-Type (a script sent as text/plain): check your files are served with correct types.
• Referrer-Policy: sites you link to see less about where visitors came from. strict-origin-when-cross-origin still sends your origin, which most referral reports need; no-referrer sends nothing.
• Permissions-Policy: a feature set to () is off for the page and every frame in it, including embedded maps, videos, payment buttons and chat widgets. Check what your page and its embeds use first.
• Cross-Origin-Opener-Policy: same-origin breaks pop-ups that talk back to your page (OAuth sign-in, PayPal and some payment windows); same-origin-allow-popups keeps them working.
• Cross-Origin-Resource-Policy: same-site or same-origin stops other sites from embedding your files (images, fonts, scripts). Files other sites embed on purpose need cross-origin.

Redirect HTTP to HTTPS

frontend http
    bind :80
    http-request redirect scheme https code 301 unless { ssl_fc }

Cookie flags

Set the flags in the application that creates the cookie.