CSP/HSTS/HPKP (security headers) on Monzo.me

[_Colin_W]

Similar to this helpful topic about HSTS…

CSP/HSTS/HPKP (security headers) on Monzo.me

This is not so much a bug report as a question. Why is HSTS not deployed on monzo.me? It’s a system that pretty much has to be completely secure considering what it handles. I’d say it’s a big target. Without HSTS the site is vulnerable to sslstrip attacks and similar. Some kind of certificate pinning is really needed. HSTS is of course a trust-on-first-connection system, so you could even go further and include the certificate directly in major browsers, but HSTS is a must at minimum.

… should the Content Security Policy HTTP response header also not be defined on all TLS websites in Monzo’s portfolio? It can help reduce cross-site scripting risk, and missing security controls like this would be reported as a vulnerability in application security testing.