[GSoC2024] Added additional security headers #7626

mach-12 · 2024-03-17T15:24:00Z

Fixes #7398
Added security headers for Referrer-Policy, X-Content-Type-Options, Content-Security-Policy.

Motivation and context

Referring to Issue #7398, Added additional security headers. Added to address the deduction in security score rating third party scanners.

Referrer-Policy "strict-origin-when-cross-origin";: Limit the referrer information sent when a user navigates away from the website
X-Content-Type-Options "nosniff";: Prevent browsers from attempting to MIME-sniff the content type of a response to reduce risk of XSS and Content Injection
Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;: Set rules to limit what resources a browser can load from out site to reduce the risk of XSS and Data Injection.

How has this been tested?

Checklist

I submit my changes into the develop branch
I have created a changelog fragment
I have updated the documentation accordingly
I have added tests to cover my changes
I have linked related issues (see GitHub docs)
I have increased versions of npm packages if it is necessary
(cvat-canvas,
cvat-core,
cvat-data and
cvat-ui)

License

I submit my code changes under the same MIT License that covers the project.
Feel free to contact the maintainers if that's a concern.

Added headers for: X-Frame-Options, Referrer-Policy, X-Content-Type-Options, Content-Security-Policy

SpecLad

Please add a changelog entry. Also, add "Fixes #7398" to the PR description so that GitHub links it to the issue.

SpecLad · 2024-03-18T17:49:42Z

cvat-ui/react_nginx.conf

+        add_header Referrer-Policy "strict-origin-when-cross-origin";
+        add_header X-Content-Type-Options "nosniff";


Suggested change

add_header Referrer-Policy "strict-origin-when-cross-origin";

add_header X-Content-Type-Options "nosniff";

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

add_header X-Content-Type-Options "nosniff" always;

Same for the other file.

SpecLad · 2024-03-18T17:54:17Z

cvat-ui/react_nginx.conf

@@ -21,6 +21,9 @@ server {
        add_header Cross-Origin-Embedder-Policy "credentialless";
        add_header Expires 0;
        add_header X-Frame-Options "deny";
+        add_header Referrer-Policy "strict-origin-when-cross-origin";
+        add_header X-Content-Type-Options "nosniff";
+        add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;


I already said this in #7398, but you did not address it: this CSP allows basically everything, so it's pretty useless. Can you come up with a more stringent policy?

mach-12 · 2024-03-18T20:24:28Z

@SpecLad I have added a more specific policy. Can you review what needs to be allowed/disallowed? I'll fix it asap.

SpecLad · 2024-03-21T16:01:10Z

cvat-ui/react_nginx.conf

@@ -21,6 +21,9 @@ server {
        add_header Cross-Origin-Embedder-Policy "credentialless";
        add_header Expires 0;
        add_header X-Frame-Options "deny";
+        add_header Referrer-Policy "strict-origin-when-cross-origin";
+        add_header X-Content-Type-Options "nosniff";
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https://app.cvat.ai; font-src 'self' https://fonts.gstatic.com; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; manifest-src 'self'; worker-src 'self'; 


script-src 'unsafe-inline' nullifies most of the advantages of CSP - are you sure it is needed?

https://app.cvat.ai should not be in there - it's specific to our CVAT instance, and is already covered by 'self'.

SpecLad · 2024-03-21T16:01:40Z

cvat/nginx.conf

+    add_header X-Frame-Options "deny";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header X-Content-Type-Options "nosniff";


You seem to have added duplicate headers.

SpecLad · 2024-03-21T16:08:39Z

cvat/nginx.conf

+    add_header X-Frame-Options "deny";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header X-Content-Type-Options "nosniff";
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https://app.cvat.ai; font-src 'self' https://fonts.gstatic.com; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; manifest-src 'self'; worker-src 'self'; 


This config will likely require a different CSP, because this instance of NGINX hosts the backend, so it should allow resources referenced by pages generated by backend. In particular, you should examine the external resources loaded by pages like:

https://<domain>/api/docs/

https://<domain>/api/swagger/

https://<domain>/api/about/

https://<domain>/django-rq/

https://<domain>/admin/

SpecLad · 2024-03-21T16:09:35Z

changelog.d/20240319_014508_mann.compi.md

@@ -0,0 +1,4 @@
+### Security


The Security category is for security fixes. This PR is not a fix, it's more of a hardening; so I think this entry belongs in the Added category.

SpecLad · 2024-03-21T16:10:08Z

changelog.d/20240319_014508_mann.compi.md

@@ -0,0 +1,4 @@
+### Security
+
+- Added security headers.


Please list which headers were added.

nmanovic · 2024-03-25T15:48:44Z

@mach-12 , will have you time to finish the PR?

mach-12 · 2024-03-25T15:52:07Z

Yes @nmanovic it's on the way. I did a security audit and I'm adding the CSP to address the issues. I also found an XSS in the Django admin dashboard.

SpecLad · 2024-04-01T11:44:45Z

Hi,

To avoid delaying this PR, let's limit the scope. Content-Security-Policy is complicated, and fairly risky to introduce, and we shouldn't hold off on adding the other two headers in this PR until we get CSP right. Let's just exclude CSP for now.

mach-12 · 2024-04-01T13:40:28Z

Hello @SpecLad
I have narrowed these down, please review

Also, there is a potential XSS risk at the admin login panel.

SpecLad · 2024-04-02T08:40:46Z

I have narrowed these down, please review

I don't understand what you want me to review. It's just a list of URLs.

Also, there is a potential XSS risk at the admin login panel.

Can you elaborate?

SpecLad · 2024-04-11T11:01:57Z

Seeing as you haven't replied for over a week, I'm going to close this. If you'd like to go back and finish this, I suggest that you reopen it, and remove the CSP header as I've proposed previously. The other two headers are fairly trivial, so we should be able to get the PR in working order quickly.

mach-12 · 2024-04-11T11:27:02Z

I have done the proposed changes @SpecLad here #7752

mach-12 added 2 commits March 17, 2024 20:41

Added headers to nginx.conf

82e7067

Added headers for: X-Frame-Options, Referrer-Policy, X-Content-Type-Options, Content-Security-Policy

Added headers to react_nginx.conf

dff5b21

Added headers for: X-Frame-Options, Referrer-Policy, X-Content-Type-Options, Content-Security-Policy

mach-12 requested a review from azhavoro as a code owner March 17, 2024 15:24

SpecLad reviewed Mar 18, 2024

View reviewed changes

mach-12 and others added 3 commits March 19, 2024 01:41

Defined better Content Security Policy in react_nginx.conf

10a7dfa

Defined better Content Security Policy in nginx.conf

7ae5d9a

added changelog fragment

b2de88b

mach-12 requested a review from nmanovic as a code owner March 18, 2024 20:21

mach-12 requested a review from SpecLad March 18, 2024 20:24

SpecLad reviewed Mar 21, 2024

View reviewed changes

nmanovic removed request for nmanovic and azhavoro March 22, 2024 14:06

SpecLad closed this Apr 11, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[GSoC2024] Added additional security headers #7626

[GSoC2024] Added additional security headers #7626

mach-12 commented Mar 17, 2024 •

edited

Loading

SpecLad left a comment

SpecLad Mar 18, 2024

SpecLad Mar 18, 2024

mach-12 commented Mar 18, 2024

SpecLad Mar 21, 2024

SpecLad Mar 21, 2024

SpecLad Mar 21, 2024

SpecLad Mar 21, 2024

SpecLad Mar 21, 2024

nmanovic commented Mar 25, 2024

mach-12 commented Mar 25, 2024

SpecLad commented Apr 1, 2024

mach-12 commented Apr 1, 2024

SpecLad commented Apr 2, 2024

SpecLad commented Apr 11, 2024

mach-12 commented Apr 11, 2024

		add_header Referrer-Policy "strict-origin-when-cross-origin";
		add_header X-Content-Type-Options "nosniff";

[GSoC2024] Added additional security headers #7626

[GSoC2024] Added additional security headers #7626

Conversation

mach-12 commented Mar 17, 2024 • edited Loading

Motivation and context

How has this been tested?

Checklist

License

SpecLad left a comment

Choose a reason for hiding this comment

SpecLad Mar 18, 2024

Choose a reason for hiding this comment

SpecLad Mar 18, 2024

Choose a reason for hiding this comment

mach-12 commented Mar 18, 2024

SpecLad Mar 21, 2024

Choose a reason for hiding this comment

SpecLad Mar 21, 2024

Choose a reason for hiding this comment

SpecLad Mar 21, 2024

Choose a reason for hiding this comment

SpecLad Mar 21, 2024

Choose a reason for hiding this comment

SpecLad Mar 21, 2024

Choose a reason for hiding this comment

nmanovic commented Mar 25, 2024

mach-12 commented Mar 25, 2024

SpecLad commented Apr 1, 2024

mach-12 commented Apr 1, 2024

SpecLad commented Apr 2, 2024

SpecLad commented Apr 11, 2024

mach-12 commented Apr 11, 2024

mach-12 commented Mar 17, 2024 •

edited

Loading