Reading-path month: March 2026. Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.
Security headers: own the final response
CDN, proxy and application may produce different settings.
Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.
Reading context
A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.
Original source ↗The architecture decision
Correct application configuration can be modified by intermediaries. Review the response reaching the browser, including error pages.
Practical application
Editorial proposal: assign an owner to each header and record its configuration point. In a hypothetical CDN-and-proxy architecture, avoid competing settings whose precedence nobody can explain.
How to verify
Compare successful responses, redirects and failures in testing, including edge-served pages. Evidence should demonstrate consistency by route and purpose, without assuming every response needs an identical policy. Changes must consider functionality depending on browser behavior.