Browser Security

Kontrollpunkter

DevTools → Network → klikk dokument-requesten → Headers. Application → Cookies.

• ›HTTPS overalt, HSTS satt, ingen mixed content (Console varsler)
• ›Cookies: Secure, HttpOnly (session), SameSite=Lax/Strict
• ›CORS: Access-Control-Allow-Origin ikke * sammen med credentials; ikke speile vilkårlig Origin
• ›CSP: begrenser script-src; unngå 'unsafe-inline' der mulig
• ›X-Content-Type-Options: nosniff
• ›Iframe-beskyttelse: frame-ancestors / X-Frame-Options
• ›Referrer-Policy: strict-origin-when-cross-origin

CORS-feil AI-en lager

return new Response(body, { headers: {
  "Access-Control-Allow-Origin": req.headers.get("origin")!,
  "Access-Control-Allow-Credentials": "true",
}});

const ALLOWED = new Set(["https://app.example.com"]);
const origin = req.headers.get("origin") ?? "";
const headers: Record<string, string> = { Vary: "Origin" };
if (ALLOWED.has(origin)) headers["Access-Control-Allow-Origin"] = origin;
return new Response(body, { headers });

Rask header-sjekk

curl -sI https://din-app.example | grep -iE \
  "strict-transport|content-security|x-frame|x-content-type|referrer-policy|set-cookie"

# CORS-test fra Console på et annet domene:
fetch("https://din-app.example/api/me", { credentials: "include" })
  .then(r => r.text()).then(console.log)  // skal feile