Add basic security

[leofeyer]

I would like to add the NelmioSecurityBundle to our default configuration and configure it with the following basic settings:

# Security configuration
nelmio_security:
    clickjacking:
        paths:
            '^/.*': SAMEORIGIN
    content_type:
        nosniff: true
    referrer_policy:
        enabled: true
        policies:
            - 'origin-when-cross-origin'
    xss_protection:
        enabled: true
        mode_block: true

These basic settings should apply (and should be applied 😄) to every website.

@contao/developers Any objections?

[aschempp]

Can you quickly sum up what this does?

[leofeyer]

It adds some security headers as e.g. described here:

https://scotthelme.co.uk/hardening-your-http-response-headers/

• X-Frame-Options "SAMEORIGIN"
• X-Content-Type-Options "nosniff"
• Referrer-Policy "origin-when-cross-origin"
• X-Xss-Protection "1; mode=block"

You can then check your website on securityheaders.io, e.g.:

https://securityheaders.io/?q=https%3A%2F%2Fhostingwerk.de&followRedirects=on

[Toflar]

Yes please! That was somewhere on my list too :) Did you check whether we could use CSP to? We're adding stuff via the $GLOBALS['TL_JAVASCRIPT'] etc. dynamically anyway so maybe we could also add nonces etc. This would greatly enhance Contao's security out-of-the-box :)

[leofeyer]

CSP is a lot more complex to implement and probably something that needs to be configured individually. The biggest hurdle are the lots of inline scripts IMO, which we add not only via $GLOBALS['TL_JAVASCRIPT'] but also directly in many of the templates.

Therefore this PR only focuses on the basic changes that are implemented quickly.

[discordier]

I like the integration of the bundle, the configuration details might have to be discussed though.

[DanielSchwiperich]

Do I see this correct that this is already implemented in 4.3.7 and max security settings are in effect since there is no contao configuration for this?

89739de

[leofeyer]

Nope: CorsBundle !== SecurityBundle 😄

[DanielSchwiperich]

😳 whoops sorry

[leofeyer]

Implemented in bb69c02 and contao/manager-bundle@57280b1.

[xchs]

I wanted to change the Referrer-Policy header since the default value of origin-when-cross-origin is not recommended. So I have added the following security configuration to the app/config/config.yml and cleared the cache:

# app/config/config.yml

# Framework configuration
framework:
    session:
        cookie_secure: true
        cookie_httponly: true

# Security configuration
nelmio_security:
    clickjacking:
        paths:
            '^/.*': DENY
    content_type:
        nosniff: true
    referrer_policy:
        enabled: true
        policies:
            - 'no-referrer'
    xss_protection:
        enabled: true
        mode_block: true
    forced_ssl:
        hsts_max_age: 31536000
        hsts_subdomains: true

I would have expected that the Referrer-Policy header set to no-referrer, but I always get Referrer-Policy: origin-when-cross-origin, no-referrer instead.

[leofeyer]

What's the matter with origin-when-cross-origin?

[xchs]

https://securityheaders.io/?q=contao.org&hide=on&followRedirects=on
https://observatory.mozilla.org/analyze.html?host=contao.org

[xchs]

The problem is further: I can easily set all those security headers on a global scope by adding the respective directives to the web server configuration. However, if I do that all the headers set by the NelmioSecurityBundle appear then twice in the Response Header. I guess there is no easy way to disable the security features provided by the NelmioSecurityBundle (besides doing a composer remove nelmio/security-bundle in which I am unsure what impact this has on the application at all)?

[ausi]

What's the matter with origin-when-cross-origin?

The difference between origin-when-cross-origin and strict-origin-when-cross-origin is that the strict version does not send any referrer if the source is on HTTPS and the target is on HTTP.

But the strict version is not supported in all browsers so we should provide a fallback I think:

Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin

According to the specification the browser should use the last value from the list that it supports. We should test that though.

[xchs]

According to the specification the browser should use the last value from the list that it supports. We should test that though.

This is already mentioned in the https://github.com/nelmio/NelmioSecurityBundle README:

…
    # Send a full URL in the `Referer` header when performing a same-origin request,
    # only send the origin of the document to secure destination (HTTPS->HTTPS),
    # and send no header to a less secure destination (HTTPS->HTTP).
    # If `strict-origin-when-cross-origin` is not supported, use `no-referrer` policy,
    # no referrer information is sent along with requests.
    referrer_policy:
        enabled: true
        policies:
            - 'no-referrer'
            - 'strict-origin-when-cross-origin'
…

https://github.com/nelmio/NelmioSecurityBundle#referrer-policy

[ausi]

But using no-referrer as the fallback will break things in Chrome, because AFAIK Contao relies on the referrer for some features.

[xchs]

I would have expected that the Referrer-Policy header set to no-referrer, but I always get Referrer-Policy: origin-when-cross-origin, no-referrer instead.

Okay, that implode() seems to be the reason why this happens. Hmm…

[leofeyer]

So what do we do?

[xchs]

I think, @ausi's proposal should be fine:

Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin

According to the specification the browser should use the last value from the list that it supports. We should test that though.

…
    referrer_policy:
        enabled: true
        policies:
            - 'origin-when-cross-origin'
            - 'strict-origin-when-cross-origin'
…

[leofeyer]

Added in 1c40bf9 and contao/manager-bundle@d999865.