Closed MillenniumFalconMechanic closed 2 years ago
@theathorn @NoopDog is there a ticket for the following findings
HTTP Strict Transport Security (HSTS) Errors and Warnings
Level: Medium To be fixed by Clever Canary Cookie Not Marked as HttpOnly
Level: Low To be fixed by Clever Canary Cookie Not Marked as Secure
Level: Low To be fixed by Clever Canary
Passive Mixed Content over HTTPS [*]
Level: Low To be fixed by Clever Canary
Superseded by #2789.
From @danielsotirhos in DataBiosphere/azul#4239:
There were 9 issues identified for https://dev.singlecell.gi.ucsc.edu/explore/ The same 9 issues and 4 others were identified for https://dev.singlecell.gi.ucsc.edu/ The 4 issues unique to https://dev.singlecell.gi.ucsc.edu/ (5, 6, 12, & 13) are marked with a [*]
HTTP Strict Transport Security (HSTS) Errors and Warnings
Cookie Not Marked as HttpOnly
Cookie Not Marked as Secure
Insecure Frame (External
Misconfigured Access-Control-Allow-Origin Header [*]
Passive Mixed Content over HTTPS [*]
Content Security Policy (CSP) NotImplemented
Expect-CT Not Enabled
SameSite Cookie Not Implemented
Subresource Integrity (SRI) NotImplemented
Cross-site Referrer Leakage through usage of strict-origin-when-cross-origin in Referrer-Policy
Email Address Disclosure [*]
Generic Email Address Disclosure [*]