Is it necessary to set secure header for JavaScript file?

Hi All,

On the OWASP Secure Headers project we got the simple question "Is it
necessary to set secure header for JavaScript file?" (
https://github.com/OWASP/www-project-secure-headers/discussions/64) and I
was not really sure about all the headers which apply to JS file.
Do you guys have any documentation or suggestion of which headers would be
applicable only a browser loads a JS file? Is that depends how the JS file
was loaded?

Best regards,
Ricardo Iramar

Received on Wednesday, 16 March 2022 12:23:22 UTC