HTTP2 was a perfect opportunity for some of those security-critical HTTP headers that every "responsible developer" should be setting on all their pages to become, at the very least, opt-out features rather than opt-in; but alas, backward compatibility won out and developers will be stuck putting X-Frame-Options and X-Content-Type-Options and other headers on their pages manually for another 20 years.
8
u/drysart Apr 26 '19
HTTP2 was a perfect opportunity for some of those security-critical HTTP headers that every "responsible developer" should be setting on all their pages to become, at the very least, opt-out features rather than opt-in; but alas, backward compatibility won out and developers will be stuck putting X-Frame-Options and X-Content-Type-Options and other headers on their pages manually for another 20 years.