Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Consider adding more security headers #8

Closed
3 tasks done
alrra opened this issue Oct 11, 2013 · 4 comments
Closed
3 tasks done

Consider adding more security headers #8

alrra opened this issue Oct 11, 2013 · 4 comments

Comments

@alrra
Copy link
Member

alrra commented Oct 11, 2013

  • X-Content-Type-Options

Done in: fa24f30

  • X-Frame-Options

Done in: fa83e20, bf163ca, 6624819 & e6b77c6

  • X-XSS-Protection

Done in: 74c8f1d & 00d3f63

More information: https://www.owasp.org/index.php/List_of_useful_HTTP_headers
@didacrios
Copy link

yeah, just requested today consider adding X-Frame-Options

@alrra
Copy link
Member Author

alrra commented Oct 11, 2013

requested adding X-Frame-Options

@Mitsurugi like I previously said: can you open a pull request ? Thanks! :)

@didacrios
Copy link

yeah, i know it i know it, but i need to understand fork properly and do the correct procedure!

@didacrios
Copy link

I think that ive done correct #9

alrra added a commit that referenced this issue Oct 31, 2013
@alrra
Add config for reducing MIME type security risks
7bd9e03 
For compatibility reasons (e.g.: legacy servers that serve all files
as `text/plain`), IE 8+ has a MIME-sniffing feature that will attempt
to determine the content-type for each downloaded resource.

In some cases, IE may report a MIME type different than the type speci-
fied by the web server. For instance, if IE finds HTML content in a file
delivered with the HTTP response header `Content-Type: text/plain`, it
determines that the content should be rendered as HTML.

Unfortunately, MIME-sniffing can also lead to security problems for
servers hosting untrusted content.

Fortunately, IE provides web apps with the ability to opt-out of
MIME-sniffing by sending the `X-Content-Type-Options` response header
with the value `nosniff`. This will prevent IE from MIME-sniffing a
response away from the declared content-type.

See also:
* http://msdn.microsoft.com/en-us/library/ie/gg622941
* http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx

Beside IE 8+, this feature has been implemented in Chrome, and may soon
come to Firefox (https://bugzilla.mozilla.org/show_bug.cgi?id=471020).

Ref: #8.
alrra added a commit that referenced this issue Oct 31, 2013
@alrra
Add config for reducing MIME type security risks
b9fc0d0 
For compatibility reasons (e.g.: legacy servers that serve all files
as `text/plain`), IE 8+ has a MIME-sniffing feature that will attempt
to determine the content-type for each downloaded resource.

In some cases, IE may report a MIME type different than the type speci-
fied by the web server. For instance, if IE finds HTML content in a file
delivered with the HTTP response header `Content-Type: text/plain`, it
determines that the content should be rendered as HTML.

Unfortunately, MIME-sniffing can also lead to security problems for
servers hosting untrusted content.

Fortunately, IE provides web apps with the ability to opt-out of
MIME-sniffing by sending the `X-Content-Type-Options` response header
with the value `nosniff`. This will prevent IE from MIME-sniffing a
response away from the declared content-type.

See also:
* http://msdn.microsoft.com/en-us/library/ie/gg622941
* http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx

Beside IE 8+, this feature has been implemented in Chrome, and may soon
come to Firefox (https://bugzilla.mozilla.org/show_bug.cgi?id=471020).

Ref: #8.
alrra added a commit that referenced this issue Nov 1, 2013
@alrra
Add ex. on how to reduce MIME type security risks
fa24f30 
For compatibility reasons (e.g.: legacy servers that serve all files
as `text/plain`), IE 8+ has a MIME-sniffing feature that will attempt
to determine the content-type for each downloaded resource.

In some cases, IE may report a different MIME type than the type speci-
fied by the web server. For instance, if IE finds HTML content in a
file delivered with the HTTP response header `Content-Type: text/plain`,
it determines that the content should be rendered as HTML. This can lead
to security problems especially for servers hosting untrusted content.

Fortunately, IE provides web apps with the ability to opt-out of
MIME-sniffing by sending the `X-Content-Type-Options` response header
with the value `nosniff`.

Beside IE 8+, this feature has recently been implemented in Chrome, and
may soon come to Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=471020.

See also:
  * http://msdn.microsoft.com/en-us/library/ie/gg622941
  * http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx

Ref: #8.
alrra pushed a commit that referenced this issue Nov 1, 2013
@alrra
Add example on how to combat clickjacking
0d465c1 
Give example on how to make Apache provide clickjacking
protection, by sending the `X-Frame-Options` header.

Ref #8.
Close #9.
alrra added a commit that referenced this issue Nov 1, 2013
@alrra
Send X-Frame-Options header only for web pages
09700d3 
Sending the `X-Frame-Options` header for everything by default,
doesn't bring any value when it comes to providing clickjacking
protection.

Even if some developers may want to send this header for some
other content (e.g.: images) to block other websites from using
it, for the majority that won't be the case.

Ref: #8
     #9
alrra added a commit that referenced this issue Nov 1, 2013
@alrra
Improve inline comments about X-Frame-Options
9112009 
Provide more information on the advantages and disadvantages of sending
the `X-Frame-Options` header, but also inform on what kind of web pages
it shoud be send for.

Ref: #8
     #9
alrra pushed a commit that referenced this issue Nov 2, 2013
@alrra
Add example on how to combat clickjacking
fa83e20 
Give example on how to make Apache provide clickjacking
protection, by sending the `X-Frame-Options` header.

Ref #8.
Close #9.
alrra added a commit that referenced this issue Nov 2, 2013
@alrra
Send X-Frame-Options header only for web pages
7bedf71 
Sending the `X-Frame-Options` header for everything by default,
doesn't bring any value when it comes to providing clickjacking
protection.

Even if some developers may want to send this header for some
other content (e.g.: images) to block other websites from using
it, for the majority that won't be the case.

Ref: #8
     #9
alrra added a commit that referenced this issue Nov 2, 2013
@alrra
Improve inline comments about X-Frame-Options
6b192da 
Provide more information on the advantages and disadvantages of sending
the `X-Frame-Options` header, but also inform on what kind of web pages
it shoud be send for.

Ref: #8
     #9
alrra added a commit that referenced this issue Nov 4, 2013
@alrra
Send X-Frame-Options header only for web pages
bf163ca 
Sending the `X-Frame-Options` header for everything by default,
doesn't bring any value when it comes to providing clickjacking
protection.

Even if some developers may want to send this header for some
other content (e.g. images) to block websites from using it,
for the majority, that won't be the case.

Ref: #8
     #9
alrra added a commit that referenced this issue Nov 4, 2013
@alrra
Improve inline comments about X-Frame-Options
6624819 
Provide more information on the advantages and disadvantages of sending
the `X-Frame-Options` header, but also inform on what kind of web pages
it shoud be send for.

Ref: #8
     #9
@alrra alrra closed this as completed in 74c8f1d Nov 4, 2013
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@didacrios @alrra