Glossary coding Term Page
Security Headers
Protective HTTP headers that shrink a page’s browser attack surface.
Core Idea
Security headers are short HTTP response fields that tell the browser to deny risky behavior: X-Frame-Options stops clickjacking, X-Content-Type-Options prevents MIME sniffing, Referrer-Policy trims sensitive URL data, and so on. They work independently of business logic, so you can add them globally through middleware.
Why It Matters Here
In FastAPI projects, SecurityMiddleware or a custom middleware stack can attach a secure default. Combining these headers with trusted host checks and well-tuned CORS preflight responses ensures browsers never expose your API to framing or spoofed origins.