Get A+ on Mozilla Observatory for servo.org

[aneeshusa]

Observatory by Mozilla is a project designed to help developers, system administrators, and security professionals configure their sites safely and securely.

Scan results: https://observatory.mozilla.org/analyze.html?host=servo.org

This should mostly entail adding headers via Ngnix.

Files:

• nginx/default

Add a new test file(s) in the tests/sls/nginx dir. See the test added in #375 for an example.

[aneeshusa]

Something that caught my eye is that we are failing the cookie test, even though we ourselves don't set any cookies. It turns out CloudFlare is adding a __cfuid cookie which 1) cannot be disabled, 2) does not have the Secure flag set, and 3) is sent even on http connections, not just https connections. I'm guessing we can't do anything about this, so that's not part of the E-easy. cc @edunham in case you know a workaround

[aneeshusa]

Oops, misclick.

[aneeshusa]

Bonus points if you utilize the actual http observatory code for the test instead of just checking headers.

[jarondl]

I have started investigating this issue, and this is my current understanding:

1. servo.org , starters.servo.org , and download.servo.org are all hosted on github pages (on separate repos) with cloudflare in-front.
   For them, the nginx configuration file is irrelevant. Maybe the headers can be added via cloudfront page rules, but i.d.k
2. build.servo.org is using the nginx server defined using saltstack. It is not even https, so it cannot pass the observatory requirements. We should first convert it to https (getting a certificate etc.), and only then can we try to get high scores on the observatory.

Are there other subdomains I haven't found?

[aneeshusa]

@jarondl The only other subdomain I know of is dl.servo.org (which currently gets TLS errors because we don't have SANs on our download.servo.org cert); maybe @edunham or @larsbergstrom knows about more about that or adding headers in cloudfront/cloudflare.

(I think download.servo.org is on S3 with some redirection magic, not GH pages.)

We are planning to add https to build.servo.org; see #423 for the tracking issue. Even while that is in progress, we can still work on adding the appropriate headers to Nginx; it's not necessary to go from ~0 to 100% in one step. I can assign you if you would like to work on this.

[jarondl]

There is also blog.servo.org, which is also gh-pages with cloudflare.
Yes, I would like to work on this, please assign me.

[aneeshusa]

@jarondl It's yours, please ask if you have any questions.

[aneeshusa]

@jarondl How is this going? Anything that I can clear up for you?

[jarondl]

Hi @aneeshusa , The headers and the simple checks were easy, just reading through the docs to see what applies. Basically, both homu and buildbot don't use external resources, so it's very easy.

Running the Mozilla observatory locally with localhost and custom ports was more involved. I have managed it locally, but I want a more robust solution before including that in the tests. It does, however, require docker and docker-compose. Both are available on travis, but not on our Vagrant setup. Do you think that's a reasonable dependency?