search

OxalisCommunity / oxalis

Oxalis - PEPPOL Access Point open source implementation - Core component
Other
119 stars 89 forks source link

Missing security headers #616

Closed cedneve closed 7 months ago

cedneve commented 1 year ago

As part of an external pentest, the following recommendation was formulated for Oxalis:

Configure the following HTTP headers: • X-Content-Type-Options • Referrer-Policy • Permissions-Policy • Content-Security-Policy • X-Frame-Options • Strict-Transport-Security (for HTTPS only)

It seems those security headers are missing in the HTTP responses leading to a medium security issue.

Could you add those or do you wish that we propose a fix to be merged into Oxalis to fix this ?

dladlk commented 1 year ago

image

runekock commented 1 year ago

@cedneve Those headers are for browsers. I don't think they accomplish anything in this context. If you disagree, please explain for each header why it is a good idea.

aaron-kumar commented 7 months ago

Things like "Strict-Transport-Security (for HTTPS only)" can be set it through Servlet container like Tomcat and e.g. through Cloudfront. Outside the scope of Oxalis. Converting it to discussion, just in case you want to continue discussion...