Missing Security Headers (ARCH8141)
Esta página aún no está disponible en tu idioma.
Key kotlin.security.missing-security-headers · Severity info · Category security · CWE CWE-693
Flags Spring Security headers disabled (headers { disable() }, frameOptions disable, hsts disable) and Ktor apps without DefaultHeaders / HSTS.
Incorrect
Section titled “Incorrect”http.headers { it.disable() }Correct
Section titled “Correct”http.headers { it.contentSecurityPolicy { c -> c.policyDirectives("default-src 'self'") } }Keep the defaults; add CSP and HSTS rather than removing X-Frame-Options and nosniff.