security-header-generator_skill

Overview

This skill generates production-ready security HTTP headers (CSP, HSTS, CORS, X-Frame-Options, etc.) for web applications to reduce risks from XSS, clickjacking, MITM, and MIME-sniffing. It detects the project type and outputs framework-specific header configurations and example code to apply them in Next.js, Express, nginx, Apache, Flask, or Django.

How this skill works

The skill scans the project to detect framework/server files and reports existing headers and recommended headers for that environment. It then produces ready-to-use configuration snippets, middleware examples, and a small test script to validate headers in production. Finally, it offers customization prompts for CSP, CORS, and Permissions-Policy based on your app’s external resources and client requirements.

When to use it

• "Add security headers to my app"
• "Setup Content Security Policy"
• "Configure CORS"
• "Enable HSTS"
• "Prevent clickjacking or secure headers for Express/Next.js/nginx"

Best practices

• Start in report-only or staging mode for CSP to avoid breaking functionality
• Prefer specific allowed origins for CORS instead of wildcard '*' when credentials are used
• Avoid 'unsafe-inline' and 'unsafe-eval' in CSP where possible; migrate inline code to nonces or hashes
• Test HSTS on staging first and use conservative max-age before enabling preload
• Monitor CSP violation reports and update policies as external dependencies change

Example use cases

• Add a strict CSP and HSTS headers to a Next.js app using next.config.js headers()
• Enable Helmet in an Express app with tailored CSP directives and CORS for allowed frontends
• Configure nginx server blocks to add security headers and handle CORS preflight responses
• Apply .htaccess headers for Apache-hosted PHP sites to enforce HTTPS and many response headers
• Use Flask-Talisman or Django security settings to centralize header enforcement and HSTS