Missing Secure HTTP Headers

By default, Phoenix HTTP responses contain a number of secure HTTP headers that attempt to mitigate XSS, click-jacking, and content-sniffing attacks.

Missing Secure HTTP Headers is flagged by sobelow when a pipeline accepts "html" requests, but does not implement the :put_secure_browser_headers plug.

Secure Headers checks can be ignored with the following command:

$ mix sobelow -i Config.Headers

False positives can be ignored at the pipeline level by adding a # sobelow_skip comment:

# sobelow_skip ["Config.Headers"]
pipeline :browser do
  ...
end

This requires the --skip flag. Listing the parent Config module instead skips every Config check on that pipeline.