<story><title>HTTP Security headers you should be using</title><url>http://ibuildings.nl/blog/2013/03/4-http-security-headers-you-should-always-be-using</url></story><parent_chain></parent_chain><comment><author>stephenr</author><text>&amp;gt; By default jQuery sends the X-Requested-With header. It was thought that the mere presence of this header could be used as a way to defeat Cross-Site Request Forgery.&lt;p&gt;By who? Who thought the mere presence of an arbitrary header made the request &amp;quot;safe&amp;quot;?&lt;p&gt;Seriously, who the fuck thought this was a good idea? I have so far seen one single use for X-Requested-With - returning a page as &amp;quot;content only&amp;quot; - i.e. omitting the header, nav, footers etc for XHR calls.</text></comment>
<story><title>HTTP Security headers you should be using</title><url>http://ibuildings.nl/blog/2013/03/4-http-security-headers-you-should-always-be-using</url></story><parent_chain></parent_chain><comment><author>jdbernard</author><text>Great article. A lot of times these &amp;quot;you should be doing this&amp;quot; articles are really annoying. It is rarely true that some advice is good for all situations. This article, however, takes the time to explain, list the purpose, and point out relevant caveats for each header. I was not aware of all of these headers, so thank you for bringing them up!</text></comment>