Webセキュリティヘッダーの設定ガイド：CSP・HSTS・X-Frame-Optionsの実装方法

1

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; object-src 'none'

1

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'; style-src 'self' 'nonce-abc123'

1
2
3
4
5
6
7
8
9

<script nonce="abc123">
  // このスクリプトは実行される
  console.log('許可されたスクリプト');
</script>

<script>
  // このスクリプトはブロックされる
  console.log('ブロックされるスクリプト');
</script>

1

Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self'; report-uri /csp-report; report-to csp-endpoint

1

Content-Security-Policy: default-src 'self'; report-uri /csp-violation-report-endpoint

1
2
3
4
5
6
7
8
9

{
  "csp-report": {
    "document-uri": "https://example.com/page.html",
    "violated-directive": "script-src 'self'",
    "blocked-uri": "https://evil.com/malicious.js",
    "source-file": "https://example.com/page.html",
    "line-number": 10
  }
}

1

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# ステップ1: 5分間のテスト
Strict-Transport-Security: max-age=300

# ステップ2: 1週間
Strict-Transport-Security: max-age=604800

# ステップ3: 1年
Strict-Transport-Security: max-age=31536000; includeSubDomains

# ステップ4: 2年 + preload
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

1
2
3
4
5

# すべてのiframe埋め込みを禁止（推奨）
X-Frame-Options: DENY

# 同一オリジンからの埋め込みのみ許可
X-Frame-Options: SAMEORIGIN

1
2
3
4
5
6
7
8

# X-Frame-Options: DENY と同等
Content-Security-Policy: frame-ancestors 'none'

# X-Frame-Options: SAMEORIGIN と同等
Content-Security-Policy: frame-ancestors 'self'

# 特定のドメインからの埋め込みを許可（X-Frame-Optionsでは不可能）
Content-Security-Policy: frame-ancestors 'self' https://trusted.example.com

1
2

X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

1

X-Content-Type-Options: nosniff

1
2

# クロスオリジンリクエストではオリジンのみを送信
Referrer-Policy: strict-origin-when-cross-origin

1

Permissions-Policy: geolocation=(), camera=(), microphone=()

1

X-DNS-Prefetch-Control: off

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

server {
    listen 443 ssl http2;
    server_name example.com;

    # SSL設定（省略）

    # セキュリティヘッダー
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; object-src 'none'" always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;

    # その他の設定...
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

<IfModule mod_headers.c>
    # Content-Security-Policy
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; object-src 'none'"

    # HSTS
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

    # X-Frame-Options
    Header always set X-Frame-Options "DENY"

    # X-Content-Type-Options
    Header always set X-Content-Type-Options "nosniff"

    # Referrer-Policy
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Permissions-Policy
    Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
</IfModule>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

const express = require('express');
const helmet = require('helmet');

const app = express();

// helmetを使用した基本設定
app.use(helmet());

// または個別にカスタマイズ
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'"],
        styleSrc: ["'self'"],
        imgSrc: ["'self'", 'data:'],
        fontSrc: ["'self'"],
        connectSrc: ["'self'"],
        frameAncestors: ["'none'"],
        formAction: ["'self'"],
        baseUri: ["'self'"],
        objectSrc: ["'none'"],
      },
    },
    strictTransportSecurity: {
      maxAge: 63072000,
      includeSubDomains: true,
      preload: true,
    },
    frameguard: { action: 'deny' },
    noSniff: true,
    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
    permissionsPolicy: {
      features: {
        geolocation: [],
        camera: [],
        microphone: [],
      },
    },
  })
);

app.listen(3000);

1

npm install helmet

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.header.writers.StaticHeadersWriter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .headers(headers -> headers
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives("default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; form-action 'self'; base-uri 'self'; object-src 'none'")
                )
                .httpStrictTransportSecurity(hsts -> hsts
                    .maxAgeInSeconds(63072000)
                    .includeSubDomains(true)
                    .preload(true)
                )
                .frameOptions(frame -> frame.deny())
                .contentTypeOptions(content -> {})
                .referrerPolicy(referrer -> referrer
                    .policy(org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN)
                )
                .permissionsPolicy(permissions -> permissions
                    .policy("geolocation=(), camera=(), microphone=()")
                )
            );

        return http.build();
    }
}

1

curl -I https://example.com