mcpField
S
security-headers-configuration

security-headers-configuration

github.com/secondskySecurity240446 installsUpdated 5w ago
Repository

About security-headers-configuration

A security skill for configuring HTTP response headers that help defend against browser-based attacks. It provides examples for Express and Nginx, plus a checklist and verification tools.

Key features

  1. 01HSTS configuration guidance
  2. 02Content Security Policy setup
  3. 03Clickjacking and MIME-sniffing defenses
  4. 04Express Helmet examples
  5. 05Nginx header configuration
  6. 06Header verification checklist

Use cases

  1. 01Adding browser security headers to Express
  2. 02Configuring headers on Nginx
  3. 03Reviewing a Content Security Policy
  4. 04Checking header settings after changes

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/secondsky/claude-skills --skill security-headers-configuration

After installing, type/security-headers-configurationin Claude Code to confirm it loaded.

Bundled filesreferences/python-apache.md

Details

From the project README

Security Headers Configuration

Implement HTTP security headers to defend against common browser-based attacks.

Essential Headers

HeaderPurposeValue
HSTSForce HTTPSmax-age=31536000; includeSubDomains
CSPRestrict resourcesdefault-src 'self'
X-Frame-OptionsPrevent clickjackingDENY
X-Content-Type-OptionsPrevent MIME sniffingnosniff

Express Implementation

const helmet = require('helmet');

app.use(helmet());

// Custom CSP
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'unsafe-inline'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
    imgSrc: ["'self'", "data:", "https:"],
    connectSrc: ["'self'", "https://api.example.com"],
    fontSrc: ["'self'", "https://fonts.gstatic.com"],
    frameAncestors: ["'none'"]
  }
}));

Nginx Configuration

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;

Verification Tools

Security Headers Checklist

  • HSTS enabled with long max-age
  • CSP configured and tested
  • X-Frame-Options set to DENY
  • X-Content-Type-Options set to nosniff
  • Referrer-Policy configured
  • Permissions-Policy disables unused features

Additional Implementations

See references/python-apache.md for:

  • Python Flask security headers middleware
  • Flask-Talisman library configuration
  • Apache .htaccess configuration
  • Header testing script

Common Mistakes

  • Setting CSP to report-only permanently
  • Using overly permissive policies
  • Forgetting to test after changes
  • Not including all subdomains in HSTS

Comments

Markdown supported