HTTP Security Headers: The Cheapest Security Your API Will Ever Ship

Some of the strongest security on your API isn't in your code at all. It's in a handful of headers — a few lines you attach to every response, which the browser then enforces on your behalf, for free,