1. Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains

Tells browsers to only connect via HTTPS for one year, even if the user types HTTP. Prevents SSL stripping attacks.

2. X-Content-Type-Options

X-Content-Type-Options: nosniff

Prevents browsers from MIME-type sniffing — treating a response as a different content type than declared. Mitigates content injection attacks.

3. X-Frame-Options

X-Frame-Options: DENY

Prevents the API’s responses from being loaded in iframes — blocks clickjacking attacks on web-facing API endpoints.

4. Content-Security-Policy (for APIs that serve HTML)

Content-Security-Policy: default-src ’none’

For pure JSON APIs, this prevents any unexpected HTML responses from executing scripts.

5. Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Controls what URL information is sent in the Referer header. Prevents sensitive URL parameters from leaking to third parties.

Security headers should be set at the API gateway, reverse proxy (nginx, Caddy), or in global middleware — not in individual endpoint handlers. This ensures they are applied consistently to all responses, including error responses and redirects that individual handlers might miss.