search

TheThingsNetwork / lorawan-stack

The Things Stack, an Open Source LoRaWAN Network Server
https://www.thethingsindustries.com/stack/
Apache License 2.0
975 stars 306 forks source link

Extend Security Headers with HSTS and CSP #2531

Closed htdvisser closed 2 years ago

htdvisser commented 4 years ago

Summary

It would be good to check and extend our security headers on HTTP endpoints.

Why do we need this?

Security.

What is already there? What do you see now?

In #2382 I just copied the existing security headers middleware.

What is missing? What do you want to see?

I think it would be good to review the current headers and add some more where possible.

htdvisser commented 2 years ago

CSP headers will be enabled by default after #4880.

HSTS was updated in https://github.com/TheThingsIndustries/lorawan-stack-aws/pull/551