Web Security Headers Quiz: 100 CSP, HSTS, CORS & Cookie Questions

Web Security Headers & Browser Defense Comprehensive Practice Exam

Master browser-enforced security mechanisms and HTTP response header configuration with this 100-question web security headers quiz. Essential for web developers, DevOps engineers, site reliability specialists, and application security practitioners, this assessment evaluates your command of HTTP headers designed to eliminate cross-site scripting, clickjacking, MIME-sniffing, and data exfiltration.

Core Security Headers & Browser Specifications

The questions examine the syntax, directive behaviors, and browser implementations of modern HTTP headers:

• Content Security Policy (CSP Level 2 & Level 3): Core fetch directives (default-src, script-src, style-src, img-src, connect-src, font-src, frame-src), strict CSP architectures using cryptographic nonces ('nonce-random') and hashes ('sha256-...'), strict-dynamic propagation, restricting frame embedding (frame-ancestors), upgrade-insecure-requests, and report-only telemetry (Content-Security-Policy-Report-Only with report-to).
• HTTP Strict Transport Security (HSTS): Enforcing HTTPS at the browser level with Strict-Transport-Security, configuring max-age durations, applying protection to subdomains (includeSubDomains), and qualifying for browser preloading lists with preload.
• Cross-Origin Resource Sharing (CORS): Understanding the Same-Origin Policy (SOP), simple requests vs preflight OPTIONS requests, headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Credentials), and the severe security risks of combining Access-Control-Allow-Origin: * with credentials.
• Cross-Origin Isolation & Spectre Defenses: Cross-Origin Opener Policy (Cross-Origin-Opener-Policy: same-origin), Cross-Origin Embedder Policy (Cross-Origin-Embedder-Policy: require-corp), and Cross-Origin Resource Policy (Cross-Origin-Resource-Policy) enabling shared memory buffers (SharedArrayBuffer) safely.
• Clickjacking & Framing Protections: Legacy X-Frame-Options (DENY, SAMEORIGIN) and modern replacement with CSP frame-ancestors.
• MIME Sniffing & Referrer Protections: Preventing MIME-confusion attacks with X-Content-Type-Options: nosniff, controlling referrer data leakage using Referrer-Policy (strict-origin-when-cross-origin, no-referrer), and disabling unneeded browser features with Permissions-Policy (formerly Feature-Policy).
• Secure Cookie Flags & Prefixes: Secure, HttpOnly, SameSite=Strict/Lax/None, and special cookie prefixes enforced by browsers (__Secure-, __Host-).

Real Configuration & Debugging Scenarios

Questions challenge you to author valid CSP headers for single-page applications without breaking analytics scripts, resolve CORS preflight errors in microservice architectures, and safely deploy HSTS without permanently breaking legacy subdomains.