search

DoTheEvo / selfhosted-apps-docker

Guide by Example
1.71k stars 122 forks source link

Increase security by adding host-prefix hardning #7

Closed QEDeD closed 4 years ago

QEDeD commented 4 years ago

I believe you already mentioned this in your Reddit post, but the only issue with the current configuration is that Nextcloud Security Scan says that "__Host-Prefix" isn't enabled configured.

A solution to this should ideally be found.

__Host-Prefix

The __Host prefix mitigates cookie injection vulnerabilities within potential third-party software sharing the same second level domain. It is an additional hardening on top of 'normal' same-site cookies.

QEDeD commented 4 years ago

Having added 'overwriteprotocol' => 'https' into config.php as mentioned in #8 actually fixes the issue with '__Host-Prefix' check failing

DoTheEvo commented 4 years ago

Troubleshooting section mentions it, I added it when android device would not connect to nextcloud without it.

I had the override in the config when I were getting just A rating with the host prefix notice.

The issue is kinda solved/not solved for me. The notebook that runs nextcloud was moved from my home to my work, where theres shitload of upload speed. This was always planned.

Now its A+ and no issues. So maybe something else plays role too.

QEDeD commented 4 years ago

Weird since I believe this was the only thing I changed between getting an A and A+ rating, as long as it works I guess.