HTTP security features
Hypertext Transfer Protocol (HTTP) provides a mechanism to interchange Hypertext, but also provides some security features that, as an API developer, you should be aware of. Let’s start by talking about Content Security Policy (CSP).
CSP
CSP is a mechanism that HTTP provides to have granular control over the restriction of loaded content. One of the most important features of CSP is XSS protection, which we already discussed in the input validation section. With CSP headers, you can restrict inline script execution, remote JavaScript execution, JavaScript eval code execution, and form submission, or even load iframes. CSP is a complex feature, so I would recommend investigating it in detail, but here is an example of how to use it from Go:
func myHandler(rw http.ResponseWriter, r *http.Request) {
rw.Header().Set("Content-Security-Policy", "default-src 'self'",
"frame-ancestors 'none'"...
