HTTP Security Headers, tarayıcıya "bu uygulamayı nasıl çalıştırmalısın?" talimatını veren HTTP başlıklarıdır. Header'lar tek başına güvenlik sağlamaz, sadece exploit surface'ini daraltır. Input validation, auth security, backend güvenliği ve diğer katmanlarla birlikte çalışırlar.
1. Content-Security-Policy (CSP) — XSS Önlemenin Ötesinde
CSP artık sadece XSS önleme değil; data exfiltration prevention, supply chain script control, iframe isolation ve inline script kontrolü sağlar.
❌ YANLIŞ (Hala XSS mümkün):
http
Content-Security-Policy: script-src 'self' 'unsafe-inline' https://cdn.com
✅ DOĞRU (Secure-by-default CSP - 2026):
http
Content-Security-Policy:
default-src 'self';
script-src 'self' 'nonce-<random>';
object-src 'none';
base-uri 'self';
frame-ancestors 'none';
form-action 'self';
upgrade-insecure-requests;
En Kritik 3 Direktif:
Direktif Neden Kritik
script-src XSS root control
object-src Legacy attack block (Flash/Java)
frame-ancestors Clickjacking koruması
Modern Reality:
'unsafe-inline' = XSS riskini geri açar
'unsafe-eval' = JavaScript injection surface
Wildcard CDN (https://*.cdn.com) = Supply chain risk
Nonce Tabanlı CSP (Production):
python
import secrets
@app.route('/')
def index():
# Her istek için benzersiz nonce
nonce = secrets.token_urlsafe(16)
template = f"""
<script nonce="{nonce}">
console.log('Secure script');
</script>
"""
response = render_template_string(template)
response.headers['Content-Security-Policy'] = (
f"default-src 'self'; "
f"script-src 'self' 'nonce-{nonce}'; "
f"object-src 'none'; "
f"base-uri 'self'; "
f"frame-ancestors 'none'; "
f"form-action 'self'; "
f"upgrade-insecure-requests"
)
return response
SRI (Subresource Integrity) ile CSP:
html
<script src="https://cdn.com/library.js"
integrity="sha384-abc123..."
crossorigin="anonymous">
</script>
2. X-Frame-Options — Artık Legacy
Gerçek Durum: Deprecated ama hâlâ destekleniyor. CSP frame-ancestors daha güçlü.
Modern Doğru Kullanım:
http
Content-Security-Policy: frame-ancestors 'none';
Not: Eski tarayıcılar için X-Frame-Options: DENY eklenebilir.
3. X-Content-Type-Options — Underrated Ama Kritik
http
X-Content-Type-Options: nosniff
Ne Engeller?
JS olarak açılan PNG/HTML
MIME confusion attacks
Content sniffing saldırıları
4. HSTS — Gerçek Dünya Kritik
http
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
⚠️ Önemli Gerçek:
preload = geri dönüş yok (permanent HTTPS lock)
Yanlış config → site brick olur
max-age = saniye cinsinden süre (1 yıl = 31536000)
HSTS Preload Listesi:
nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
5. Permissions-Policy — Modern Tracking Savunması
Gerçek Risk:
Camera/microphone abuse
Geolocation leak
Clipboard hijacking (modern phishing)
Modern Secure Default:
http
Permissions-Policy:
geolocation=(),
camera=(),
microphone=(),
usb=(),
payment=(),
clipboard-write=(),
clipboard-read=(),
fullscreen=(self)
6. COOP / COEP / CORP — Modern Web Isolation Stack
Ne Yapar?
Cross-origin memory isolation
Spectre/Meltdown mitigasyonu
Cross-tab attacks engelleme
Shared memory leaks önleme
Modern Stack:
http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin
⚠️ Yan Etki:
Bazı CDN'ler bozulabilir
Analytics kırılabilir
3rd-party scripts çalışmayabilir
COEP ile CDN Kullanımı (cross-origin):
http
# CDN kaynaklarında CORP header'ı gerekir
Cross-Origin-Resource-Policy: cross-origin
7. Cookie Security — Gerçek Exploit Yüzeyi
Modern Secure Cookie:
http
Set-Cookie: session=abc123;
HttpOnly;
Secure;
SameSite=Strict;
Path=/;
Max-Age=3600;
Flag Korumaları:
Flag Koruma
HttpOnly XSS cookie theft
Secure MITM saldırıları
SameSite=Strict CSRF
SameSite=Lax CSRF (daha esnek)
8. Cache-Control — Auth Bypass Killer
❌ Yanlış:
http
Cache-Control: public
✅ Doğru:
http
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: private, max-age=0
Kritik Gerçek:
Login response cache'lenirse = session hijack surface.
9. Eksik Ama Önemli Header'lar
Production'da kritik olanlar:
Security.txt:
http
/.well-known/security.txt
txt
Contact: [email protected]
Expires: 2026-12-31T00:00:00.000Z
Acknowledgments: https://hedef.com/security/acknowledgments
Report-To / Reporting-Endpoints (CSP Raporlama):
http
Report-To: {
"group": "csp-endpoint",
"max_age": 10886400,
"endpoints": [{"url": "https://hedef.com/csp-report"}]
}
Cross-Origin-Resource-Policy (CORP):
http
Cross-Origin-Resource-Policy: same-origin
Security Headers Maturity Model:
Seviye Özellikler
Level 1 (Basic) X-Frame-Options, X-XSS-Protection, basic CSP
Level 2 (Secure) Strict CSP (no unsafe-inline), HSTS, Secure cookies
Level 3 (Modern Production) CSP nonce-based, COOP/COEP enabled, Permissions policy locked, no third-party scripts (or strictly controlled)
Level 4 (High Security) Zero inline JS, strict isolation, full SRI, CSP reporting pipeline
Komple Güvenli Header Seti (Production - Level 3):
http
# HSTS (1 yıl + preload)
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
# CSP (nonce-based + SRI)
Content-Security-Policy:
default-src 'self';
script-src 'self' 'nonce-<random>' 'strict-dynamic';
object-src 'none';
base-uri 'self';
frame-ancestors 'none';
form-action 'self';
upgrade-insecure-requests;
report-uri /csp-report;
# Clickjacking koruması
X-Frame-Options: DENY
# MIME sniffing
X-Content-Type-Options: nosniff
# Referrer
Referrer-Policy: strict-origin-when-cross-origin
# Permissions
Permissions-Policy:
geolocation=(),
camera=(),
microphone=(),
usb=(),
payment=(),
clipboard-write=(),
clipboard-read=()
# Isolation
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin
# Cache
Cache-Control: no-store, no-cache, must-revalidate
# Reporting
Report-To: {"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://hedef.com/csp-report"}]}
Nginx Uygulaması (Production):
nginx
# HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# CSP (dynamic nonce ile)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$request_id' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests; report-uri /csp-report;" always;
# Diğer header'lar
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), usb=(), payment=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
Security Headers Kontrol Listesi (Production):
Zorunlu:
Strict-Transport-Security (HSTS) var mı?
Content-Security-Policy (CSP) var mı? (unsafe-inline yok mu?)
X-Frame-Options: DENY var mı?
X-Content-Type-Options: nosniff var mı?
Referrer-Policy var mı?
Permissions-Policy var mı?
Cross-Origin-Opener-Policy: same-origin var mı?
Cross-Origin-Embedder-Policy: require-corp var mı?
Cookie Güvenliği:
HttpOnly flag var mı?
Secure flag var mı?
SameSite=Strict veya Lax var mı?
İleri Seviye:
SRI (Subresource Integrity) kullanılıyor mu?
CSP nonce-based mi?
CSP raporlama var mı?
Security.txt dosyası var mı?
Report-To header'ı var mı?
En Önemli Takeaway:
Security headers = browser attack surface firewall
Ama:
❌ Input validation yerine geçmez
❌ Auth security yerine geçmez
❌ Backend security yerine geçmez
❌ WAF yerine geçmez
Defense in Depth katmanlarının sadece bir parçasıdır.
1. Content-Security-Policy (CSP) — XSS Önlemenin Ötesinde
CSP artık sadece XSS önleme değil; data exfiltration prevention, supply chain script control, iframe isolation ve inline script kontrolü sağlar.
❌ YANLIŞ (Hala XSS mümkün):
http
Content-Security-Policy: script-src 'self' 'unsafe-inline' https://cdn.com
✅ DOĞRU (Secure-by-default CSP - 2026):
http
Content-Security-Policy:
default-src 'self';
script-src 'self' 'nonce-<random>';
object-src 'none';
base-uri 'self';
frame-ancestors 'none';
form-action 'self';
upgrade-insecure-requests;
En Kritik 3 Direktif:
Direktif Neden Kritik
script-src XSS root control
object-src Legacy attack block (Flash/Java)
frame-ancestors Clickjacking koruması
Modern Reality:
'unsafe-inline' = XSS riskini geri açar
'unsafe-eval' = JavaScript injection surface
Wildcard CDN (https://*.cdn.com) = Supply chain risk
Nonce Tabanlı CSP (Production):
python
import secrets
@app.route('/')
def index():
# Her istek için benzersiz nonce
nonce = secrets.token_urlsafe(16)
template = f"""
<script nonce="{nonce}">
console.log('Secure script');
</script>
"""
response = render_template_string(template)
response.headers['Content-Security-Policy'] = (
f"default-src 'self'; "
f"script-src 'self' 'nonce-{nonce}'; "
f"object-src 'none'; "
f"base-uri 'self'; "
f"frame-ancestors 'none'; "
f"form-action 'self'; "
f"upgrade-insecure-requests"
)
return response
SRI (Subresource Integrity) ile CSP:
html
<script src="https://cdn.com/library.js"
integrity="sha384-abc123..."
crossorigin="anonymous">
</script>
2. X-Frame-Options — Artık Legacy
Gerçek Durum: Deprecated ama hâlâ destekleniyor. CSP frame-ancestors daha güçlü.
Modern Doğru Kullanım:
http
Content-Security-Policy: frame-ancestors 'none';
Not: Eski tarayıcılar için X-Frame-Options: DENY eklenebilir.
3. X-Content-Type-Options — Underrated Ama Kritik
http
X-Content-Type-Options: nosniff
Ne Engeller?
JS olarak açılan PNG/HTML
MIME confusion attacks
Content sniffing saldırıları
4. HSTS — Gerçek Dünya Kritik
http
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
⚠️ Önemli Gerçek:
preload = geri dönüş yok (permanent HTTPS lock)
Yanlış config → site brick olur
max-age = saniye cinsinden süre (1 yıl = 31536000)
HSTS Preload Listesi:
nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
5. Permissions-Policy — Modern Tracking Savunması
Gerçek Risk:
Camera/microphone abuse
Geolocation leak
Clipboard hijacking (modern phishing)
Modern Secure Default:
http
Permissions-Policy:
geolocation=(),
camera=(),
microphone=(),
usb=(),
payment=(),
clipboard-write=(),
clipboard-read=(),
fullscreen=(self)
6. COOP / COEP / CORP — Modern Web Isolation Stack
Ne Yapar?
Cross-origin memory isolation
Spectre/Meltdown mitigasyonu
Cross-tab attacks engelleme
Shared memory leaks önleme
Modern Stack:
http
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin
⚠️ Yan Etki:
Bazı CDN'ler bozulabilir
Analytics kırılabilir
3rd-party scripts çalışmayabilir
COEP ile CDN Kullanımı (cross-origin):
http
# CDN kaynaklarında CORP header'ı gerekir
Cross-Origin-Resource-Policy: cross-origin
7. Cookie Security — Gerçek Exploit Yüzeyi
Modern Secure Cookie:
http
Set-Cookie: session=abc123;
HttpOnly;
Secure;
SameSite=Strict;
Path=/;
Max-Age=3600;
Flag Korumaları:
Flag Koruma
HttpOnly XSS cookie theft
Secure MITM saldırıları
SameSite=Strict CSRF
SameSite=Lax CSRF (daha esnek)
8. Cache-Control — Auth Bypass Killer
❌ Yanlış:
http
Cache-Control: public
✅ Doğru:
http
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: private, max-age=0
Kritik Gerçek:
Login response cache'lenirse = session hijack surface.
9. Eksik Ama Önemli Header'lar
Production'da kritik olanlar:
Security.txt:
http
/.well-known/security.txt
txt
Contact: [email protected]
Expires: 2026-12-31T00:00:00.000Z
Acknowledgments: https://hedef.com/security/acknowledgments
Report-To / Reporting-Endpoints (CSP Raporlama):
http
Report-To: {
"group": "csp-endpoint",
"max_age": 10886400,
"endpoints": [{"url": "https://hedef.com/csp-report"}]
}
Cross-Origin-Resource-Policy (CORP):
http
Cross-Origin-Resource-Policy: same-origin
Security Headers Maturity Model:
Seviye Özellikler
Level 1 (Basic) X-Frame-Options, X-XSS-Protection, basic CSP
Level 2 (Secure) Strict CSP (no unsafe-inline), HSTS, Secure cookies
Level 3 (Modern Production) CSP nonce-based, COOP/COEP enabled, Permissions policy locked, no third-party scripts (or strictly controlled)
Level 4 (High Security) Zero inline JS, strict isolation, full SRI, CSP reporting pipeline
Komple Güvenli Header Seti (Production - Level 3):
http
# HSTS (1 yıl + preload)
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
# CSP (nonce-based + SRI)
Content-Security-Policy:
default-src 'self';
script-src 'self' 'nonce-<random>' 'strict-dynamic';
object-src 'none';
base-uri 'self';
frame-ancestors 'none';
form-action 'self';
upgrade-insecure-requests;
report-uri /csp-report;
# Clickjacking koruması
X-Frame-Options: DENY
# MIME sniffing
X-Content-Type-Options: nosniff
# Referrer
Referrer-Policy: strict-origin-when-cross-origin
# Permissions
Permissions-Policy:
geolocation=(),
camera=(),
microphone=(),
usb=(),
payment=(),
clipboard-write=(),
clipboard-read=()
# Isolation
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin
# Cache
Cache-Control: no-store, no-cache, must-revalidate
# Reporting
Report-To: {"group":"csp-endpoint","max_age":10886400,"endpoints":[{"url":"https://hedef.com/csp-report"}]}
Nginx Uygulaması (Production):
nginx
# HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
# CSP (dynamic nonce ile)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$request_id' 'strict-dynamic'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests; report-uri /csp-report;" always;
# Diğer header'lar
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=(), usb=(), payment=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header Cache-Control "no-store, no-cache, must-revalidate" always;
Security Headers Kontrol Listesi (Production):
Zorunlu:
Strict-Transport-Security (HSTS) var mı?
Content-Security-Policy (CSP) var mı? (unsafe-inline yok mu?)
X-Frame-Options: DENY var mı?
X-Content-Type-Options: nosniff var mı?
Referrer-Policy var mı?
Permissions-Policy var mı?
Cross-Origin-Opener-Policy: same-origin var mı?
Cross-Origin-Embedder-Policy: require-corp var mı?
Cookie Güvenliği:
HttpOnly flag var mı?
Secure flag var mı?
SameSite=Strict veya Lax var mı?
İleri Seviye:
SRI (Subresource Integrity) kullanılıyor mu?
CSP nonce-based mi?
CSP raporlama var mı?
Security.txt dosyası var mı?
Report-To header'ı var mı?
En Önemli Takeaway:
Security headers = browser attack surface firewall
Ama:
❌ Input validation yerine geçmez
❌ Auth security yerine geçmez
❌ Backend security yerine geçmez
❌ WAF yerine geçmez
Defense in Depth katmanlarının sadece bir parçasıdır.
