sebsauvage/ZeroBin — pull request #70 by Talenka (2013-12-10 14:55:01+00:00)
Title: Prevent data leaks with CSP and HSTS Headers

These headers add two security layers against MITM and XSRF attacks, respectively. Since security is a major feature of this project, they should not be ignored.

* Adding the `Strict-Transport-Security` header, you locks the traffic on https protocol for a day (86400 seconds). If the server is not https-capable, this security layer is simply ignored by browser. See: https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security

* Adding the `Content-Security-Policy` header, you forbid the browser to load scripts from another domain. This help to address tricky code injections (e.g. unicode tag attributes bypass or `javascript:` URI in users comments). See: https://developer.mozilla.org/en-US/docs/Security/CSP/CSP_policy_directives#script-src

For paranoid people, you should even use `header("Content-Security-Policy: default-src 'self'");` to prevent anything to be loaded except for the very server which run ZeroBin.