Browser security boundaries
Security headers: CSP, HSTS, COOP, COEP and CORP
Understand each header’s threat boundary and side effects.
Understand the concept
Pasting a header list is not a security architecture. CSP constrains scripts and resources; nonces, hashes and report-only rollout can support migration. Broad allowances weaken its effect. nosniff limits content-type interpretation, while Referrer-Policy controls URL information sent elsewhere. Secrets still do not belong in URLs.
HSTS influences secure transport in browsers. Subdomain and preload decisions have lasting consequences. COOP concerns browsing-context relationships, COEP sets requirements for embedded resources, and CORP constrains cross-origin resource use. Origin and site are distinct concepts.
Cross-origin isolation can enable features but may affect login popups or external media. Review dependencies and rollout evidence before enforcing it. Different response types may need different policies. None of these headers grants or checks resource permissions. Verify console reports, network responses and actual workflows together.
When strengthening frontend policies without breaking workflows.
Blindly applying one security-header list to every endpoint.
One topic. Three levels of depth.
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-originThe fields manage different data boundaries.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
You enabled HSTS. Is /admin authorisation still necessary?
Show the solution and explanation
Yes: transport policy does not decide permissions.Yes. Secure transport is not resource permission.