"Not a Pentest" Trust-Anker: Security Headers schützen Browser-Benutzer. Keine Angriffswerkzeuge.
Was sind Security Headers für OpenClaw?
Security Headers umfassen Content-Security-Policy, HSTS, X-Frame-Options, Permissions-Policy und Referrer-Policy. Sie schützen Browser-Benutzer vor XSS, Clickjacking und Datenlecks durch HTTP-Header-Konfiguration.
CSP verhindert bis zu 95% aller XSS-Angriffe bei korrekter Implementierung.
OpenClaw Security Headers Guide
Alle Security Headers für OpenClaw — von CSP über HSTS bis hin zu Permissions-Policy. Implementierung in Next.js mit A+ securityheaders.com Rating.
📋 Headers Übersicht
| Header | Schutz | Kritisch |
|---|---|---|
| Strict-Transport-Security | HSTS – HTTPS erzwingen | 🔴 Ja |
| Content-Security-Policy | XSS Prevention | 🔴 Ja |
| X-Frame-Options | Clickjacking Prevention | 🔴 Ja |
| X-Content-Type-Options | MIME Sniffing Prevention | 🔴 Ja |
| Referrer-Policy | Referrer Leakage | 🟡 Empfohlen |
| Permissions-Policy | Browser APIs sperren | 🟡 Empfohlen |
| X-XSS-Protection | Legacy XSS Filter | 🟡 Empfohlen |
| Cross-Origin-Opener-Policy | Cross-Origin Isolation | 🟡 Empfohlen |
⚙️ Next.js Konfiguration
// next.config.js — Security Headers für OpenClaw
const securityHeaders = [
{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
{ key: 'X-Frame-Options', value: 'DENY' },
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'X-XSS-Protection', value: '1; mode=block' },
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=(), interest-cohort=()' },
{ key: 'Cross-Origin-Opener-Policy', value: 'same-origin' },
{ key: 'Cross-Origin-Resource-Policy', value: 'same-site' },
{
key: 'Content-Security-Policy',
value: [
"default-src 'self'",
"script-src 'self' 'unsafe-inline' 'unsafe-eval'", // Adjust for your needs
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data: https:",
"font-src 'self'",
"connect-src 'self' https://api.clawguru.org",
"frame-ancestors 'none'",
].join('; ')
},
];
module.exports = {
async headers() {
return [{ source: '/(.*)', headers: securityHeaders }];
},
};