headers

• Threats

  • Cross Site Scripting
  • Insufficient Transport Layer Security
  • Clickjacking

• Browser has to implement the header

• It's a control client side

• If it doesn't recognize a header it ignores it