Back to Details

security-headers

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Security Headers Skill

安全标头Skill

Overview

概述

Audit and configure HTTP security headers for web applications.
审计并配置Web应用的HTTP安全标头。

Required Headers

必需标头

HeaderPurposeSeverity if Missing
Content-Security-PolicyPrevent XSS/injectionHIGH
Strict-Transport-SecurityForce HTTPSHIGH
X-Content-Type-OptionsPrevent MIME sniffingMEDIUM
X-Frame-OptionsPrevent clickjackingMEDIUM
Referrer-PolicyControl referrer infoLOW
Permissions-PolicyControl browser featuresLOW
X-XSS-ProtectionLegacy XSS filterLOW
标头用途缺失时的严重程度
Content-Security-Policy防止XSS/注入攻击HIGH
Strict-Transport-Security强制使用HTTPSHIGH
X-Content-Type-Options防止MIME类型嗅探MEDIUM
X-Frame-Options防止点击劫持MEDIUM
Referrer-Policy控制引用信息LOW
Permissions-Policy控制浏览器功能LOW
X-XSS-Protection旧版XSS过滤器LOW

Workflow

工作流程

  1. Detect framework (Next.js, Laravel, Express, etc.)
  2. Check current header configuration
  3. Compare against security best practices
  4. Generate framework-specific configuration
  5. Validate headers are properly set
  1. 检测框架（Next.js、Laravel、Express等）
  2. 检查当前标头配置
  3. 对比安全最佳实践
  4. 生成针对特定框架的配置
  5. 验证标头是否正确设置

Detection Points

检测位置

FrameworkConfig Location
Next.js
next.config.js
headers, 
middleware.ts
Laravel
SecurityHeaders
middleware
Express
helmet
middleware
Django
SECURE_*
settings
框架配置位置
Next.js
next.config.js
标头、
middleware.ts
Laravel
SecurityHeaders
中间件
Express
helmet
中间件
Django
SECURE_*
设置

References

参考资料

  • Headers Reference
  • Config Templates
  • 标头参考文档
  • 配置模板