jake/jarv.is
1
Fork 0
mirror of https://github.com/jakejarvis/jarv.is.git synced 2025-07-21 19:21:18 -04:00
Code Issues Activity

more hi-res images (except shodan post)

Browse Source
This commit is contained in:
Jake Jarvis
2019-08-29 13:24:25 -04:00
parent 180a8eacf5
commit 0cfc58daf6
8 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
content/notes/security-headers-cloudflare-workers/index.md
View File

@@ -13,13 +13,13 @@ draft: false
---
![A+ security grade for this website](images/security-headers.png)
{{< image src="images/security-headers.png" width="700" alt="A+ security grade for this website" >}}
In 2019, it's becoming more and more important to harden websites via HTTP response headers, which all modern browsers parse and enforce. Multiple standards have been introduced over the past few years to protect users from various attack vectors, including `Content-Security-Policy` for injection protection, `Strict-Transport-Security` for HTTPS enforcement, `X-XSS-Protection` for cross-site scripting prevention, `X-Content-Type-Options` to enforce correct MIME types, `Referrer-Policy` to limit information sent with external links, [and many, many more](https://www.netsparker.com/whitepaper-http-security-headers/).
[Cloudflare Workers](https://www.cloudflare.com/products/cloudflare-workers/) are a great feature of [Cloudflare](https://www.cloudflare.com/) that allows you to modify responses on-the-fly between your origin server and the user, similar to [AWS Lambda](https://aws.amazon.com/lambda/) (but much simpler). We'll use a Worker to add the headers.
![Cloudflare Workers](images/cf-workers.png)
{{< image src="images/cf-workers.png" width="650" alt="Cloudflare Workers" >}}
Workers can be enabled for $5/month via the [Cloudflare Dashboard](https://dash.cloudflare.com/). (It's worth noting, once enabled, Workers can be used on *any zone* on your account, not just one website!).