Expanded HTTP Header Security Support (8.0.0)
FortiWeb 8.0.0 enhances the HTTP Header Security feature—now located under the new Client Side Security module—with support for additional browser-enforced headers. This update improves control over browser behavior, strengthens client-side isolation, and supports FortiWeb’s layered defense strategy for modern web applications.
HTTP Header Security plays a foundational role FortiWeb's Layered Defense Strategy—Stage 1: Prevent Attacks Before They Happen—where protections are applied before any JavaScript executes. By injecting security headers into server responses, FortiWeb instructs the browser to enforce constraints on script execution, cross-origin access, feature usage, and client-side storage.
Administrators can configure HTTP Header Security under Web Protection > Client-Side Security > HTTP Header Security, where individual headers can be enabled, customized, and applied through Web Protection Profiles. These profiles are then referenced by Server Policies in inline, reverse proxy, or WCCP deployments.
This design centralizes control, reduces configuration complexity, and ensures that browser-layer defenses are deployed consistently across all protected applications.
Why This Matters
Modern web applications frequently embed third-party content and rely on dynamic scripting. Without strict browser policies, attackers can exploit this flexibility to hijack sessions, steal sensitive data, and abuse cross-origin capabilities.
FortiWeb’s enhanced HTTP Header Security helps prevent these attacks by:
-
Hardening browser execution environments to enforce isolation and reduce attack surfaces
-
Controlling cross-origin behavior with policies like COOP, COEP, and CORP
-
Enabling safe staging of strict CSP policies using report-only modes
-
Managing browser data and feature permissions through headers like Clear-Site-Data and Permissions-Policy
These protections reduce reliance on complex JavaScript inspection and offer enforcement directly at the browser level, where they are most effective.
What’s New in FortiWeb 8.0.0
The following new headers are now supported:
|
Header |
Description |
|---|---|
|
Content-Security-Policy-Report-Only |
FortiWeb adds the Content-Security-Policy-Report-Only HTTP header to monitor content security policy violations without enforcing restrictions. Use this header to test and fine-tune policy settings by collecting violation reports from the browser. |
|
Cross-Origin-Resource-Policy (CORP) |
Prevents other origins from loading your resources by enforcing same-origin rules for resource access. The Cross-Origin-Resource-Policy header can be configured with one of the following values:
Use in conjunction with CORS Protection for more granular control. |
|
Cross-Origin-Embedder-Policy (COEP) |
Requires cross-origin resources embedded in the page (such as scripts, styles, and images) to explicitly grant permission via CORS or CORP headers. The Cross-Origin-Embedder-Policy header can be configured with:
This setting is required for enabling high-privilege APIs like SharedArrayBuffer. |
|
Cross-Origin-Opener-Policy (COOP) |
Isolates your browsing context from cross-origin popups or tabs to prevent side-channel attacks. The Cross-Origin-Opener-Policy header can be configured with:
Improves security for applications dealing with sensitive data or embedded login flows. |
|
Clear-Site-Data |
Instructs the browser to clear local storage, cookies, cache, and other site data when triggered (e.g., on logout). The Clear-Site-Data header can be configured with:
Improves session cleanup and prevents residual data exposure on shared devices. |
These headers complement existing support for X-Frame-Options and X-XSS-Protection, providing broader and more modern protections aligned with browser security best practices.
For more information, see HTTP Security Headers.