OpenVAPTWeb Security Headers and Cookies
The HTTP response headers and cookie flags that let browsers defend users against cross-site scripting, clickjacking and session theft.
OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/p5.html. Offline: openvapt learn P5.
Read First: F3
You Will Be Able To
- Explain what Content-Security-Policy, X-Frame-Options and X-Content-Type-Options defend against.
- Explain the Secure, HttpOnly and SameSite cookie flags.
Browser-Enforced Defences
A Content-Security-Policy limits where scripts can load from, turning many cross-site scripting bugs into blocked requests. frame-ancestors or X-Frame-Options stop other sites framing yours for clickjacking. nosniff stops browsers guessing file types. Referrer-Policy and Permissions-Policy limit data leakage and powerful features.
Cookie Flags
Secure keeps a cookie off plain HTTP. HttpOnly hides it from JavaScript, so an XSS bug cannot read the session. SameSite limits when it is sent with cross-site requests, which reduces cross-site request forgery.
In Summary
Headers tell the browser what to allow. CSP limits scripts and frame-ancestors stops clickjacking. Cookies need the Secure, HttpOnly and SameSite flags.
Apply It
These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.
| Check | Title | Severity |
|---|---|---|
WEB-CK-001 | Cookies Missing Secure, HttpOnly or SameSite | Medium |
WEB-COR-001 | Cross-Origin Resource Sharing Allows Any Origin With Credentials | Medium |
WEB-HDR-002 | Missing Content Security Policy | Medium |
WEB-HDR-003 | Site Can Be Framed (Clickjacking) | Medium |
WEB-HDR-004 | Missing X-Content-Type-Options | Low |
WEB-HDR-005 | Missing Referrer-Policy | Low |
WEB-HDR-006 | Missing Permissions-Policy | Low |
WEB-PHP-005 | PHP Session Cookies Not Hardened | Medium |
WEB-SEC-001 | No security.txt Contact File | Info |
Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Lab
Run: openvapt demo --only WEB-HDR-,WEB-CK-Open your browser's developer tools on any site you own and compare its response headers with the checks.
Check Yourself
Answers are checked in your browser and never stored or sent.
References
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). P5: Web Security Headers and Cookies (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p5.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_p5,
author = {{OpenVAPT}},
title = {{P5: Web Security Headers and Cookies}},
year = {2026},
howpublished = {\url{https://openvapt.com/academy/p5.html}},
note = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.