search

ASL-19 / civicdr-backend

GNU General Public License v3.0
0 stars 1 forks source link

CDR-01-001 Web: Complete lack of HTTP Security headers #8

Closed seamustuohy closed 7 years ago

seamustuohy commented 7 years ago

It was found that the frontend and backend websites fail to deploy HTTP Security headers. This unnecessarily exposes CiviCDR users to Clickjacking, XSS, TLS channel downgrade attacks and other similar client-side attacks. The issue can be replicated as one navigates to the website and backend URLs provided next. Note to observe the returned HTTP headers.

It is recommended to change the above header composition to something like the following. Please note that fixing the headers on the amazonaws.com subdomain will require employing a web server other than Amazon S3 since the S3 does not allow custom HTTP headers.

seamustuohy commented 7 years ago

Changing the headers will be accomplished using a nginx proxy hosted on Heroku.

seamustuohy commented 7 years ago

Addressed in pull request #25