T
security cors csp xss csrf web-dev

Web Security Headers and Attacks: CORS, CSP, XSS, and CSRF

Protect your web applications from common threats. Learn how to implement security headers like CSP and HSTS to defend against XSS and CSRF attacks.

2026-04-11

Web Security Headers and Common Attacks: A Comprehensive Guide

Securing a modern web application requires a multi-layered approach. From the network layer where firewalls filter traffic to the application layer where security headers instruct browsers on how to behave, every layer plays a critical role. This guide explores the essential tools and headers you need to know to defend against the most common web attacks.

1. Network Layer Defense: Firewalls and Intrusion Prevention

The first line of defense is often at the server level. Tools like firewalls and intrusion prevention systems monitor incoming traffic and block malicious actors before they even reach your application.

Firewall Tools: iptables, nftables, and ufw

  • iptables: The traditional Linux firewall tool for managing IPv4 packet filtering and NAT. It uses "chains" and "rules" to decide what to do with incoming packets.
  • nftables: The modern successor to iptables, designed to replace it with a more efficient and flexible syntax. It provides a unified framework for both IPv4 and IPv6.
  • ufw (Uncomplicated Firewall): A user-friendly interface for managing iptables/nftables. It is the default firewall configuration tool for Ubuntu and is perfect for developers who want simple, easy-to-manage rules.

fail2ban

fail2ban is an intrusion prevention software that protects servers from brute-force attacks. It scans log files for repeated failed login attempts and updates firewall rules to "ban" the IP addresses for a specified duration.

2. Essential Web Security Headers

Security headers are HTTP response headers that tell the browser how to handle your site's content. They are a powerful, low-overhead way to mitigate many types of attacks.

CSP (Content Security Policy)

CSP is one of the most important security headers. It allows you to specify which sources of content (scripts, styles, images) are trusted. By restricting where scripts can be loaded from, CSP is the primary defense against XSS (Cross-Site Scripting).

HSTS (HTTP Strict Transport Security)

HSTS tells the browser that the website should only be accessed via HTTPS. This prevents "SSL stripping" attacks and ensures that all communication is encrypted.

SRI (Subresource Integrity)

SRI is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It uses a cryptographic hash to ensure the file's integrity.

CORS (Cross-Origin Resource Sharing)

While not strictly a "security header" in the sense of adding a lock, CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. Properly configuring CORS is vital to prevent unauthorized data access.

3. Understanding and Mitigating Common Attacks

XSS (Cross-Site Scripting)

XSS occurs when an attacker injects malicious scripts into a trusted website. This can be used to steal cookies, session tokens, or sensitive information.

  • Defense: Use CSP, sanitize user input, and encode data before rendering it in the browser.

CSRF (Cross-Site Request Forgery)

CSRF is an attack that forces an authenticated user to execute unwanted actions on a web application in which they are currently authenticated.

  • Defense: Use anti-CSRF tokens, SameSite cookie attributes, and verify the Origin or Referer headers.

SSRF (Server-Side Request Forgery)

In an SSRF attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker might supply a URL that the server-side application will make a request to.

  • Defense: Validate user-supplied URLs, use allowlists for outgoing requests, and restrict internal network access from the application server.

Conclusion

Web security is a continuous process of improvement and monitoring. By combining robust network-level tools like ufw and fail2ban with strong application-level headers like CSP and HSTS, you can significantly reduce the attack surface of your applications. Stay informed, keep your tools updated, and always prioritize the security of your users' data.

Back to Blog