Enhancement #602
open
Deploy Content Security Policy (CSP) and check other security headers
30%
Description
We should have a look at this: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
Full specification: https://www.w3.org/TR/CSP/
Updated by Marc Dequènes over 6 years ago
This FF plugin could be handy: https://addons.mozilla.org/en-US/firefox/addon/laboratory-by-mozilla/
Updated by Marc Dequènes over 6 years ago
- Related to Enhancement #571: Secure HTTP settings added
Updated by Marc Dequènes over 6 years ago
- % Done changed from 0 to 10
Tested on test.duckcorp.org and fixed a few things. Now applied on www.duckcorp.org.
The FF plugin had a false positive on script-src 'unsafe-inline'. I found the error reporting clearer on Chromium.
Updated by Marc Dequènes over 6 years ago
Content Security Policy: The page’s settings blocked the loading of a resource at https://irconweb.milkypond.org/#chan-1 (“form-action 'none'”).
Updated by Marc Dequènes over 5 years ago
- Subject changed from Experiment with Content Security Policy (CSP) to Deploy Content Security Policy (CSP) and check other security headers
- % Done changed from 10 to 30
It works, even if finding the right setting may need some trial and error.
I've already setup certain vhosts and certain applications may provide one (Nexcloud), so let's list the vhost needing one and fix them one by one.
I should also check the result of: https://securityheaders.com/
I updated the httpd role for more secure headers. I need to have a look at duplicate headers.
Updated by Marc Dequènes over 4 years ago
The Mozilla checker is interesting, especially for the CSP analysis. I'll make some fixes for our website soon and then try to add support for more vhosts.
Updated by Marc Dequènes over 4 years ago
- ca.duckcorp.org
- db.duckcorp.org
- ddns.duckcorp.org
- dico.duckcorp.org
- doc.duckcorp.org
- gossip.duckcorp.org
- lists.duckcorp.org
- myip.duckcorp.org
- ntp.duckcorp.org
- projects.duckcorp.org
- radio.duckcorp.org
- repository.duckcorp.org
- shizuka-STAR.duckcorp.org
- smokeping.duckcorp.org
- sources.duckcorp.org
- static.perso.duckcorp.org
stuff.milkypond.org(handled by NextCloud)- sup.duckcorp.org
- users.duckcorp.org
- vcs.duckcorp.org
- vcs-git.duckcorp.org
- vcs-git-viewer.duckcorp.org
webmail.duckcorp.org- wiki.duckcorp.org
www.duckcorp.orgwww.milkypond.org(redirection)
- perso.duckcorp.org: each user needs to adapt to its own need
- photos-ng.duckcorp.org: experimental at the moment
Updated by Marc Dequènes over 4 years ago
updated currently deployed CSP to use upgrade-insecure-requests