search

TeamMentor / TM_4_0_Design

Repo Holds TM 4.x issues
4 stars 3 forks source link

Add security headers #208

Open DinisCruz opened 9 years ago

DinisCruz commented 9 years ago

Description

No security-focused headers are sent to the user

Risk Analysis

Couple headers should be added (enforce ssl for example) Since Jade doesn't use Html, we should use CSP to block all Javascript execution

References

TM-4.0-Security

DinisCruz commented 9 years ago

@tekgirl77 or @michaelhidalgo this is another nice one for you to get your head around TM 4.0 dev and UnitTest development

tekgirl77 commented 9 years ago

Ran into issue during testing - the error below in screenshot persists in Chrome (Version 39.0.2171.95 (64-bit)) no matter how I update the existing helmetjs CSP code - even if I remove the code, the error persists. Only on the /guest/about.html and /guest/features.html pages. "Help", "Login" and "Sign Up" pages all load successfully. In Firefox, ALL pages load successfully.

The screenshot below was taken after all csp code has been commented out, my cache cleared, npm update, and restart of the server:

image

tekgirl77 commented 9 years ago

Solution to above issue: disable cache in developer tools in Chrome.

screen shot 2015-01-14 at 3 19 16 pm

romichg commented 9 years ago

Good catch with the cache!

tekgirl77 commented 9 years ago

@luchia Hi Lucy, Dinis said I should ping you on this one - there is an option w/ the CSP (content security policy) headers to submit data on policy violations in json format - wondering if we are interested in collecting this data, having it emailed to the team / individual, etc. so that we can be alerted when someone comes across a portion of our site that is blocked to to the policy in place.

In the screenshot below, you can see the json key:value pairs that it will report on:

screen shot 2015-01-14 at 3 18 22 pm

tekgirl77 commented 9 years ago

@michaelhidalgo I was told to ping you for access to Saucelabs for multi-browser testing.

michaelhidalgo commented 9 years ago

Sure, I'm sending you the credentials in an encrypted email

2015-01-14 15:32 GMT-06:00 tekgirl77 notifications@github.com:

@michaelhidalgo https://github.com/michaelhidalgo I was told to ping you for access to Saucelabs for multi-browser testing.

— Reply to this email directly or view it on GitHub https://github.com/TeamMentor/TM_4_0_Design/issues/208#issuecomment-69996070 .

Michael Hidalgo http://michaelhidalgocr.blogspot.com

The future has many names: For the weak, it means the unattainable. For the fearful, it means the unknown. For the courageous, it means opportunity. (1802-1885) French Poet, Dramatist, Writer

tekgirl77 commented 9 years ago

Notes:

screen shot 2015-01-16 at 10 58 40 am

screen shot 2015-01-16 at 11 20 05 am

screen shot 2015-01-16 at 11 22 59 am

DinisCruz commented 9 years ago

@tekgirl77 cool stuff, can you review the current TeamMentor articles on CSP and if they need some changes please propose them (there is GitHub repo for contents changes)

tekgirl77 commented 9 years ago

Will do! :)

Salle Ingle Support & Implementation Specialist, eLearning [image: https://www.securityinnovation.com/_img/art/logo.png]

On Fri, Jan 16, 2015 at 12:14 PM, Dinis Cruz notifications@github.com wrote:

@tekgirl77 https://github.com/tekgirl77 cool stuff, can you review the current TeamMentor articles on CSP and if they need some changes please propose them (there is GitHub repo for contents changes)

— Reply to this email directly or view it on GitHub https://github.com/TeamMentor/TM_4_0_Design/issues/208#issuecomment-70296365 .

michaelhidalgo commented 9 years ago

Great analysis !

tekgirl77 commented 9 years ago

@luchia https://github.com/tekgirl77/TM_4_0_Design/tree/Issue_208_Add_security_headers

tekgirl77 commented 9 years ago

Just an example of processing the CSP reports: https://mathiasbynens.be/notes/csp-reports

tekgirl77 commented 9 years ago

@DinisCruz reassigning to you since you wanted to do additional testing with it once I submitted the PR.