Security Headers Configurator

中级security最低上下文：16K

Configures HTTP security headers to harden web applications. Covers Content-Security-Policy (including nonces and strict-dynamic), HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, and cookie flags. Produces server/CDN configuration, explains tradeoffs, and provides a rollout plan using report-only mode to avoid breakage.

security-headerscsphstsweb-securityhardening

使用场景

  • Writing a strict Content-Security-Policy with nonces
  • Enabling HSTS and secure cookie flags
  • Configuring COOP/COEP for cross-origin isolation
  • Rolling out CSP safely with report-only mode
  • Auditing existing headers for gaps

示例提示词

Configure security headers for our web app served by [nginx/Cloudflare/Express].
Provide:
1. A strict CSP using nonces and strict-dynamic
2. HSTS, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options
3. Secure cookie flags
4. A report-only rollout plan to catch breakage
5. The exact config snippet for our server/CDN

推荐模型

claude-opus-4-6gpt-5gemini-2-5-prodeepseek-v4

兼容工具

claude-codecursorkiroany

模态

输入: text, code
→
输出: text, code

相关 Skills

security-auditthreat-modelingoauth-flow-implementer

作者

OpenModels Community

@openmodelsrun