Add security headers to the default response #110

xh3n1 · 2018-08-28T11:55:34Z

Added security headers such as:

'X-Content-Type-Options' =>'nosniff',
'Content-Security-Policy' => "default-src 'none'",
 'X-Frame-Options' => 'DENY'

Fix #111

oliverklee · 2018-08-28T13:22:11Z

src/ViewHandler/SecuredViewHandler.php

+     *
+     * @return Response
+     */
+    public function createResponse(ViewHandler $handler, View $view, Request $request, $format)


Can we cover this with an integration test?

We can have the string type hinting for the parameter.

oliverklee · 2018-08-28T13:22:47Z

composer.json

@@ -128,6 +128,9 @@
                        "messages": {
                            "Symfony\\Component\\HttpKernel\\Exception\\BadRequestHttpException": true
                        }
+                    },
+                    "service": {
+                        "view_handler": "my.secure_view_handler"



Please let's drop this empty line.

xh3n1 · 2018-08-30T12:37:44Z

@oliverklee Thank you for the review 😄
I made the changes, and actually wrote a system test for the SecuredViewHandler. Also fixed #112

oliverklee · 2018-09-10T16:46:33Z

.travis.yml

+- >
+  echo;
+  echo "Running the system tests";
+  vendor/bin/phpunit tests/System/;


@xh3n1 Thanks for the change.

I'd like to stick to the "one change/topic per PR" policy. Could you please move this to a separate PR? This will keep the history (and git blame) clean and allow for clean reverts if needed. Thanks!

@oliverklee Thanks, I added it as a separate PR.

oliverklee

Looks generally good with minor things to polish.

Could you also please rebase from master and add a changelog entry? Thanks! 🍪

oliverklee · 2018-09-12T09:45:27Z

config/services.yml

+    my.secure_view_handler:
+      parent: fos_rest.view_handler.default
+      calls:
+       - ['registerHandler', [ 'json', ["@my.secure_handler", 'createResponse'] ] ]


Please let's unify this to always use single quotes unless the double quotes are required here.

oliverklee · 2018-09-12T09:47:56Z

src/ViewHandler/SecuredViewHandler.php

+    {
+        $view->setHeaders([
+            'X-Content-Type-Options' => 'nosniff',
+            'Content-Security-Policy' => "default-src 'none'",


Would it also work to switch the single and double quotes here?

oliverklee · 2018-09-12T09:47:58Z

src/ViewHandler/SecuredViewHandler.php

+ */
+class SecuredViewHandler
+{
+


Please let's drop the blank line here.

oliverklee · 2018-09-12T09:48:07Z

src/ViewHandler/SecuredViewHandler.php

+
+/**
+ * This class is used to add headers to the default response.
+ * @author Xheni Myrtaj <xheni@phplist.com> .


Let's polish this: :-)

Could you please add a blank line above the @author line and drop the period at the end of the @author line?

oliverklee · 2018-09-12T09:48:09Z

src/ViewHandler/SecuredViewHandler.php

+     */
+    public function createResponse(ViewHandler $handler, View $view, Request $request, string $format)
+    {
+        $view->setHeaders([


Please let's put the [ and ] on separate lines. This will avoid formatting changes when using the PhpStorm autoformat or the php-cs-fixer.

oliverklee · 2018-09-12T09:49:23Z

tests/System/Controller/SecuredViewHandlerTest.php

@@ -0,0 +1,70 @@
+<?php
+declare(strict_types=1);
+namespace PhpList\RestBundle\Tests\System\Controller;


To keep things consistent, please let's have a blank line between the declare line and the namespace section.

oliverklee · 2018-09-12T09:49:43Z

tests/System/Controller/SecuredViewHandlerTest.php

+ * Test for security headers
+ * @author Xheni Myrtaj <xheni@phplist.com>
+ *
+ *


Please let's remove the blank lines.

oliverklee · 2018-09-12T09:50:04Z

tests/System/Controller/SecuredViewHandlerTest.php

+
+/**
+ * Test for security headers
+ * @author Xheni Myrtaj <xheni@phplist.com>


For consistency, please let's have a blank line above the @author line.

oliverklee · 2018-09-12T09:50:39Z

tests/System/Controller/SecuredViewHandlerTest.php

+ */
+class SecuredViewHandlerTest extends TestCase
+{
+


Please let's drop the blank line. (In general, there should be no blank line below a { or above a }.)

oliverklee · 2018-09-12T09:51:11Z

tests/System/Controller/SecuredViewHandlerTest.php

+        $expectedHeaders = [
+            'X-Content-Type-Options' => 'nosniff',
+            'Content-Security-Policy' => "default-src 'none'",
+            'X-Frame-Options' => 'DENY'


Please let's have a comma after the last array element.

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

xh3n1 · 2018-09-12T11:54:44Z

Thanks for the review @oliverklee I applied the requested coding style and rebased to master. I hope that I didn't miss anything. Just a question about changelog.md, under which release should I add the changes?

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

oliverklee · 2018-09-12T12:51:05Z

Just a question about changelog.md, under which release should I add the changes?

Under "x.y.z (next release)", please.

oliverklee · 2018-09-12T12:52:00Z

src/ViewHandler/SecuredViewHandler.php

+     *
+     * @return Response
+     */
+    public function createResponse(ViewHandler $handler, View $view, Request $request, string $format)


Would it work to have Response as a return type declaration?

Yes, it works.

xh3n1 · 2018-09-12T13:15:50Z

ok thanks @oliverklee , I will create another PR for that.

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

oliverklee · 2018-09-12T13:42:12Z

I will create another PR for that.

Optimally, the changelog entry for a PR should be part of the same PR.

src/ViewHandler/SecuredViewHandler.php

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

oliverklee

Beautiful!

xh3n1 force-pushed the set-header branch 2 times, most recently from 0727e1e to f05824c Compare August 28, 2018 12:13

xh3n1 requested a review from samtuke August 28, 2018 12:21

oliverklee suggested changes Aug 28, 2018

View reviewed changes

xh3n1 changed the title ~~Add security headers to the default response~~ Add security headers to the default response and run the system tests on Travis Aug 30, 2018

oliverklee suggested changes Sep 10, 2018

View reviewed changes

xh3n1 force-pushed the set-header branch from 55c88ba to 18aa744 Compare September 10, 2018 19:13

xh3n1 changed the title ~~Add security headers to the default response and run the system tests on Travis~~ Add security headers to the default response Sep 10, 2018

oliverklee suggested changes Sep 12, 2018

View reviewed changes

xh3n1 added 7 commits September 12, 2018 13:47

Set security headers to response

86612db

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

Add integration test for security headers

565505f

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

Add string type hinting for the format parameter

a98df9c

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

Remove the empty line

80c5aa7

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

Fix the securedViewHandlerTest

8bf208b

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

Apply the requested coding style

ff18b12

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

Add comma after last array element

7058ed2

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

xh3n1 force-pushed the set-header branch from 09d7ae7 to 7058ed2 Compare September 12, 2018 11:48

Drop empty line

478040e

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

oliverklee reviewed Sep 12, 2018

View reviewed changes

Declare Response as a return type

b89eb54

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

oliverklee reviewed Sep 12, 2018

View reviewed changes

src/ViewHandler/SecuredViewHandler.php Outdated Show resolved Hide resolved

Space after :

131eae3

Signed-off-by: Xheni Myrtaj <myrtajxheni@gmail.com>

xh3n1 mentioned this pull request Sep 12, 2018

Update changelog with added changes #114

Merged

Update services.yml

821195b

oliverklee approved these changes Sep 19, 2018

View reviewed changes

oliverklee merged commit c8e3636 into master Sep 19, 2018

oliverklee deleted the set-header branch September 19, 2018 11:58

Add security headers to the default response #110

Add security headers to the default response #110

Uh oh!

Conversation

xh3n1 commented Aug 28, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xh3n1 commented Aug 30, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

oliverklee left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xh3n1 commented Sep 12, 2018

Uh oh!

oliverklee commented Sep 12, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xh3n1 commented Sep 12, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oliverklee commented Sep 12, 2018

Uh oh!

Uh oh!

oliverklee left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

xh3n1 commented Aug 28, 2018 •

edited

Loading

xh3n1 commented Sep 12, 2018 •

edited

Loading