---
title: "P5: Web Security Headers and Cookies"
canonical: https://openvapt.com/academy/p5.html
html: https://openvapt.com/academy/p5.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# P5: Web Security Headers and Cookies

The HTTP response headers and cookie flags that let browsers defend users against cross-site scripting, clickjacking and session theft.

- Level: Practitioner
- Time: about 20 minutes
- Read first: F3

## You Will Be Able To

- Explain what Content-Security-Policy, X-Frame-Options and X-Content-Type-Options defend against.
- Explain the Secure, HttpOnly and SameSite cookie flags.

## Browser-Enforced Defences

A Content-Security-Policy limits where scripts can load from, turning many cross-site scripting bugs into blocked requests. frame-ancestors or X-Frame-Options stop other sites framing yours for clickjacking. nosniff stops browsers guessing file types. Referrer-Policy and Permissions-Policy limit data leakage and powerful features.

## Cookie Flags

Secure keeps a cookie off plain HTTP. HttpOnly hides it from JavaScript, so an XSS bug cannot read the session. SameSite limits when it is sent with cross-site requests, which reduces cross-site request forgery.

## In Summary

Headers tell the browser what to allow. CSP limits scripts and frame-ancestors stops clickjacking. Cookies need the Secure, HttpOnly and SameSite flags.

## Apply It

- [WEB-CK-001 Cookies Missing Secure, HttpOnly or SameSite](https://openvapt.com/checks/WEB-CK-001.md) (medium)
- [WEB-COR-001 Cross-Origin Resource Sharing Allows Any Origin With Credentials](https://openvapt.com/checks/WEB-COR-001.md) (medium)
- [WEB-HDR-002 Missing Content Security Policy](https://openvapt.com/checks/WEB-HDR-002.md) (medium)
- [WEB-HDR-003 Site Can Be Framed (Clickjacking)](https://openvapt.com/checks/WEB-HDR-003.md) (medium)
- [WEB-HDR-004 Missing X-Content-Type-Options](https://openvapt.com/checks/WEB-HDR-004.md) (low)
- [WEB-HDR-005 Missing Referrer-Policy](https://openvapt.com/checks/WEB-HDR-005.md) (low)
- [WEB-HDR-006 Missing Permissions-Policy](https://openvapt.com/checks/WEB-HDR-006.md) (low)
- [WEB-PHP-005 PHP Session Cookies Not Hardened](https://openvapt.com/checks/WEB-PHP-005.md) (medium)
- [WEB-SEC-001 No security.txt Contact File](https://openvapt.com/checks/WEB-SEC-001.md) (info)

## Lab

1. `Run: openvapt demo --only WEB-HDR-,WEB-CK-`
2. `Open your browser's developer tools on any site you own and compare its response headers with the checks.`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. Which header limits where scripts may load from?
   - A. Referrer-Policy
   - B. Content-Security-Policy
   - C. Server
   - D. Strict-Transport-Security
   - Answer: B. CSP controls allowed sources for scripts and other resources.

2. The HttpOnly cookie flag:
   - A. Hides the cookie from JavaScript
   - B. Encrypts the cookie
   - C. Makes the cookie permanent
   - D. Sends the cookie only over HTTPS
   - Answer: A. An XSS bug cannot read an HttpOnly cookie. Sending only over HTTPS is the Secure flag.

3. Clickjacking is prevented by:
   - A. frame-ancestors or X-Frame-Options
   - B. HSTS
   - C. Compression
   - D. The SameSite cookie flag
   - Answer: A. They stop other sites framing your pages.

4. Which cookie flag keeps a cookie off plain HTTP connections?
   - A. HttpOnly
   - B. Secure
   - C. SameSite
   - D. Path
   - Answer: B. Secure means the browser sends the cookie only over HTTPS.

5. What does the SameSite cookie flag help reduce?
   - A. Cross-site request forgery
   - B. SQL injection
   - C. Clickjacking
   - D. TLS downgrade
   - Answer: A. SameSite limits when a cookie is sent with cross-site requests, which reduces CSRF.

6. What does X-Content-Type-Options: nosniff do?
   - A. Stops browsers guessing file types
   - B. Blocks all scripts
   - C. Hides the server version
   - D. Turns off caching
   - Answer: A. nosniff makes the browser trust the declared content type instead of guessing, so a file cannot be treated as script by mistake.

## Key Terms

- Content Security Policy: An HTTP response header that tells browsers which sources of scripts and other content a page may load.
- Cross-Site Scripting: XSS: injecting script into a web page so it runs in other users' browsers.
- Clickjacking: Tricking a user into clicking something on a hidden, framed copy of another site.
- Cookie Flags: Attributes such as Secure, HttpOnly and SameSite that control when and how a browser sends or exposes a cookie.
- CSRF: Cross-site request forgery: tricking a logged-in user's browser into sending an unwanted request to another site.

## References

- [OWASP Secure Headers Project](https://owasp.org/projects/secure-headers-project)
- [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)

Offline: `openvapt learn P5`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p5.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.