浏览器安全响应头统一基线与灰度发布最佳实践

一、基线头集合Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Content-Security-Policy: default-src 'none'; script-src 'self' 'strict-dynamic'; connect-src 'self'; img-src 'self'; style-src 'self'; frame-ancestors 'none'

Referrer-Policy: no-referrer

X-Content-Type-Options: nosniff

Permissions-Policy: camera=(), microphone=(), geolocation=()

Cross-Origin-Opener-Policy: same-origin

Cross-Origin-Embedder-Policy: require-corp

二、灰度切换中间件type Res = { setHeader: (k: string, v: string) => void }

function applyBaseline(res: Res) {

res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload')

res.setHeader('Content-Security-Policy', "default-src 'none'; script-src 'self' 'strict-dynamic'; connect-src 'self'; img-src 'self'; style-src 'self'; frame-ancestors 'none'")

res.setHeader('Referrer-Policy', 'no-referrer')

res.setHeader('X-Content-Type-Options', 'nosniff')

res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')

res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')

res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')

}

function applyStrict(res: Res) {

res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')

res.setHeader('Content-Security-Policy', "default-src 'none'; script-src 'self' 'strict-dynamic'; connect-src 'self'; img-src 'self'; style-src 'self'; frame-ancestors 'none'; report-to csp-endpoint")

res.setHeader('Referrer-Policy', 'no-referrer')

res.setHeader('X-Content-Type-Options', 'nosniff')

res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')

res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')

res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')

}

function headersMiddleware(stage: 'baseline' | 'strict') {

return function (_req: any, res: Res, next: Function) {

if (stage === 'baseline') applyBaseline(res)

else applyStrict(res)

next()

}

}

三、验收清单HSTS开启并包含`includeSubDomains; preload`，仅在HTTPS环境发布；CSP语法正确且默认拒绝。`nosniff`与`no-referrer`设置一致；Permissions-Policy最小化权限集合。灰度切换生效并带`report-to`；COOP/COEP组合提升跨源隔离。