Page Comparison

Response Header

General RequirementWhen?

For Web UI

For API

Content-Type

...; charset=utf-8

Yes

alwaysYes

Strict-Transport-Security^[1]

max-age=10886400; includeSubDomains; preload

For all Web UIs that are only accessible via HTTPSYes (is HTTPS)

Yes

X-XSS-Protection^[2]

1; mode=block

For all Web UIs. Not required for APIs.Yes

No

X-Frame-Options

SAMEORIGINFor all Web UIs. Not required for APIs.

Yes

No

Referrer Policy

same-originFor all Web UIs. Not required for APIs.

Yes

No

X-Content-Type-Options^[3]

nosniffFor all Web UIs. Not required for APIs.

Yes

No

Response Header

General RequirementWhen?

For Web UI

For API

Set-Cookie

… ;httpOnly; secure; SameSiteWeb UIs that

Yes, when they transfer of confidential data in cookies

Yes, when they transfer of confidential data in cookies

Cache-Control

no-cache, no-store

Whenever confidential data is transmitted.

Whenever confidential data is transmitted.

Pragma

no-cache

Expires

-1

Content-Security-Policy^[4]

object-src 'none'; script-src ‘self’ [URL1] [URL2]; style-src ‘self’ unsafe-inline; object-src ‘self‘;base-uri 'none';

General recommendation for new for all Web UIs. Not required for APIs.

No

object-src 'none';
script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http:;
base-uri 'none';
report-uri https://your-report-collector.example.com/

Recommendation for new Web UIs that have to use inline script blocks (e.g. if integrated by a JS framework).

Do not use this setting if you do not have to since it disables CSP protection for older browsers!

No

Content-Disposition

attachment; filename=<filename>

Web UIs  at which users can download files that are potentially untrusted.

No

X-Download-Options

noopen

No