Complete Guide to HTTP Headers (Caching, Security & Semantics)

# Harden HTTP Response Headers in Nginx
server {
    listen 443 ssl http2;
    server_name curious-techie.com;

    # Enforce strict TLS transport (HSTS) for 1 year including subdomains
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Prevent MIME type sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # Defense against clickjacking
    add_header X-Frame-Options "DENY" always;

    # Control referrer information leak
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Restrict device capabilities and APIs
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

    # Modern Content Security Policy
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-rAnd0m'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self';" always;
}

// Express.js Caching Strategies

// 1. Immutable Hashed Static Assets (JS/CSS bundles with content hash)
app.use('/assets', express.static('public/assets', {
  maxAge: '1y',
  immutable: true, // Browser never revalidates hashed asset during 1 year
  setHeaders: (res) => {
    res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
  }
}));

// 2. Dynamic HTML Pages (Must always revalidate for freshest content)
app.get('/', (req, res) => {
  res.setHeader('Cache-Control', 'public, no-cache');
  res.setHeader('ETag', 'W/"v2.4.0-hash"');
  res.render('index');
});

// 3. Sensitive User Data / Account Settings (Never store on disk or shared cache)
app.get('/api/account', (req, res) => {
  res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, private');
  res.setHeader('Pragma', 'no-cache'); // Legacy HTTP/1.0 backward compatibility
  res.json({ user: 'alex', balance: 500 });
});