# Keycloak and Owasp directive

**URL:** <https://forum.keycloak.org/t/keycloak-and-owasp-directive/27900>\
**Category:** Configuring the server\
**Created:** [September 17, 2024, 2:14pm UTC](https://forum.keycloak.org/t/keycloak-and-owasp-directive/27900 "2024-09-17T14:14:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nestle2377](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nestle2377/32/3163_2.png) [@nestle2377](https://forum.keycloak.org/u/nestle2377)\
**Post date:** [September 17, 2024, 2:14pm UTC](https://forum.keycloak.org/t/keycloak-and-owasp-directive/27900/1 "2024-09-17T14:14:18Z")

</div>

Hi everyone, I have a keycloak 22.0.1 server, they require me to implement the following security headers: X-Content-Type-Options , Content-Security-Policy and Strict-Transport-Security following the owasp directives.  
I haven’t found much about it, since http is exposed by quarkus I imagine it needs to be worked on. Do you know how to act in this case? Maybe the latest versions of keycloak already provide this type of checks?

thanks!

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [September 17, 2024, 3:28pm UTC](https://forum.keycloak.org/t/keycloak-and-owasp-directive/27900/2 "2024-09-17T15:28:17Z")

</div>

You can configure this in the realm settings of each realm.