一些低危提示漏洞的处理
无关痛痒的一些漏洞
HTTP X-XSS-Protection 响应头缺失
HTTP X-Download-Options 响应头缺失
HTTP X-Content-Type-Options 响应头缺失
HTTP X-Permitted-Cross-Domain-Policies 响应头缺失
HTTP Content-Security-Policy 响应头缺失
HTTP Strict-Transport-Security 响应头缺失
HTTP Referer-Policy 响应头缺失
点击劫持：缺少X-Frame-Options头
1、php.ini文件中，确保以下设置
expose_php off // php彩蛋信息泄露 session.cookie_httponly=true // cookie没有设置httponly属性
2、处理方式PHP代码或者服务器端加入对应的响应（2选1）
PHP代码的处理方式：
header("X-Frame-Options:SAMEORIGIN;"); // X-Frame-Options 响应头缺失
header("Referer-Policy:origin;");//Referer-Policy 响应头缺失
header("Content-Security-Policy:frame-ancestors 'self';");//Content-Security-Policy 响应头缺失
header("X-Permitted-Cross-Domain-Policies:'master-only';");//X-Permitted-Cross-Domain-Policies 响应头缺失
header("X-XSS-Protection:1; mode=block;");//X-XSS-Protection 响应头缺失
header("X-Download-Options: SAMEORIGIN;");//X-Download-Options 响应头缺失
header("X-Content-Type-Options:nosniff;");//X-Content-Type-Options 响应头缺失
header("Strict-Transport-Security:max-age=31536000;");//Strict-Transport-Security 响应头缺失Nginx服务器设置
add_header X-Frame-Options SAMEORIGIN; add_header Referer-Policy origin; add_header Content-Security-Policy "frame-ancestors 'self'"; add_header X-Permitted-Cross-Domain-Policies "master-only"; add_header X-XSS-Protection "1; mode=block;"; add_header X-Download-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; add_header Strict-Transport-Security max-age=31536000;
