Best practice regarding Security-Relevant HTTP Headers

[magosk]

Hi. As we finally seem to have fixes and workarounds for a working IntraWeb and CGDevTools combination I am revisiting this issue. I think I will look at this in two steps, first make sure we comply to the first three headers, then look at CSP separately. I still need to know best practice on when and how to set these headers. Should I set them for every reply or is it sufficient at the beginning of the session? In the first case, is e.g. ServerController.OnAfterDispatch a good place? (We already have some code in this event handler) Or are there other properties and/or events that do the job better?

Best regards

Magnus Oskarsson