missing-security-headers-anti-pattern

HTTP security headers defend against XSS, clickjacking, and man-in-the-middle attacks at the browser level. Applications failing to send these headers rely on insecure browser defaults, missing a powerful declarative security layer.

The anti-pattern is omitting security headers from HTTP responses. Browsers default to permissive policies; servers must instruct stricter controls.

Implement a middleware or a global response filter in your application that adds the following headers to all outgoing responses.

누락된 보안 헤더에 대한 보안 안티 패턴(CWE-16). 웹 애플리케이션 코드, 서버 구성 또는 HTTP 응답 처리를 생성하거나 검토할 때 사용합니다. 누락된 CSP, HSTS, X-Frame-Options 및 기타 보호 헤더를 감지합니다. 출처: igbuend/grimbard.