After dual writes (30 Oct), this post covers HTTP security headers: CSP, HSTS, framing controls, referrer policy, permissions policy, COOP/COEP when needed, report-only rollout and why headers never replace server authz.

सुरक्षाशीर्षधर्मः: A Metrical Codification of HTTP Security Headers (with English glosses)

What this post is about

HTTP security headers are response directives that constrain browser behavior for scripts, framing, transport and powerful features.

Topics covered

1. Headers as browser perimeter
2. Content-Security-Policy
3. HSTS
4. Frame ancestors / clickjacking
5. Referrer-Policy
6. Permissions-Policy
7. COOP COEP CORP when needed
8. Report-only then enforce
9. Headers are not server authz
10. Links to authz and key management

Sanskrit title

सुरक्षाशीर्षधर्मः = surakṣā-śīrṣa-dharmaḥ “dharma of security headers”.

English

Minimizable; Sanskrit-first.

ग्राह्यम् / Keep

१. tight CSP: minimal unsafe-inline
२. HSTS long max-age: staged preload
३. block hostile framing: CSP frame-ancestors
४. minimize referrers: stop query leaks
५. lock unused features: Permissions-Policy
६. report-only first: then enforce
७. server authz always: headers complement only

त्याज्यम् / Avoid

• CSP with blanket unsafe-inline as done
• enforce strict CSP with zero report period
• treat headers as replacement for authz checks

पदच्छेदः
उत्तरशीर्षेषु रक्षा यदि ब्राउजर् आज्ञां शृणोति । सुरक्षाशीर्षधर्मस्तस्माद् परिधिः ॥१॥

Word-for-word

Gloss table

English sense
HTTP security headers tell browsers how to treat your origin: scripts frames transport and referrers. They are perimeter policy in header form.

Context / topic
Topic: why security headers. Distinct from authn tokens and API authz.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
CSP script default-src स्पष्टम् । unsafe-inline बहुदोषः ॥२॥

Word-for-word

Gloss table

English sense
Content-Security-Policy should whitelist script sources tightly. Broad unsafe-inline undoes most XSS value of CSP.

Context / topic
Topic: CSP.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
HSTS force HTTPS long max-age । http residual द्वारम् ॥३॥

Word-for-word

Gloss table

English sense
HSTS keeps returning users on HTTPS after the first safe visit. Leave preload decisions conscious and staged.

Context / topic
Topic: HSTS.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
X-Frame-Options or frame-ancestors । clickjack मा ॥४॥

Word-for-word

Gloss table

English sense
Block unexpected embedding of sensitive pages. Prefer CSP frame-ancestors over legacy headers alone when possible.

Context / topic
Topic: framing.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
Referrer-Policy minimize leak । full URL foreign origin ॥५॥

Word-for-word

Gloss table

English sense
Tighten referrers so tokens in query strings do not ride to third parties on every navigation.

Context / topic
Topic: referrer.

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
Permissions-Policy feature lockdown । camera mic default open भयम् ॥६॥

Word-for-word

Gloss table

English sense
Disable powerful browser features your app does not need. Defaults are not a security review.

Context / topic
Topic: permissions.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
COOP COEP CORP isolation when needed । cross-origin confuse मा ॥७॥

Word-for-word

Gloss table

English sense
Use cross-origin opener and embedder policies when you need strong isolation or privileged APIs. They are not free defaults for every site.

Context / topic
Topic: isolation headers.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
report-only then enforce । big-bang CSP outage ॥८॥

Word-for-word

Gloss table

English sense
Roll CSP in report-only, fix real violations then enforce. Instant strict CSP without measurement breaks production.

Context / topic
Topic: rollout.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
headers != authz server checks । client perimeter only ॥९॥

Word-for-word

Gloss table

English sense
Security headers shape the browser. They never replace server-side authorization on every sensitive action.

Context / topic
Topic: not a substitute for authz.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
प्राप्याधिकारः who may act शीर्षाणि how browser behaves । कुञ्जीप्रबन्धः secret life ॥१०॥

Word-for-word

Gloss table

English sense
Authz decides who may act; headers decide how browsers load your origin; key management decides secret life cycle. Complementary layers.

Context / topic
Topic: series distinctions.

सन्धिः: अधिकार कर्ता; शीर्ष परिधि; कुञ्जी रहस्य।

वृत्तमिति: एकादशाक्षराः पादाः।

पदच्छेदः
CSP HSTS frame referrer rollout पञ्चकम् । एभिः सुरक्षाशीर्षधर्मः परिधिसमन्वितः ॥११॥

Word-for-word

Gloss table

English sense
Five limbs: tight CSP, durable HSTS, frame protection, tight referrers and report-then-enforce rollout plus feature lockdown.

Context / topic
Topic: checklist.

वृत्तमिति: ८-८-८-८।

पदच्छेदः
इति सुरक्षाशीर्षधर्मसारः परिधिसमन्वितः । मितं शीर्षरक्षणं क्रियायोग्यं तन्त्रधर्मः स उच्यते ॥१२॥

Word-for-word

Gloss table

English sense
Closing: teach the browser strict habits then still authorize every sensitive act on the server.

Context / topic
Topic: close.

उपसंहारन्यायः: CSPं दृढं कुरु; HSTSं दीर्घं देहि; सर्वरं मा विस्मर।

वृत्तमिति: ८-८-८-८।

१. Why headers
२. CSP
३. HSTS
४. Framing
५. Referrer
६. Permissions
७. Isolation
८. Rollout
९. Not authz
१०. Series layers
११. Five limbs
१२. Close

1. Prior: authz 2026-10-08; keys 2026-10-19; dual write 2026-10-30.
2. Domain: HTTP security headers.
3. English minimizable; Sanskrit-first.
4. Style: no em dash; no Oxford comma in English clauses.