search

dani-garcia / vaultwarden

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
GNU Affero General Public License v3.0
39.02k stars 1.89k forks source link

Nginx configuation add_header Permissions-Policy #1226

Closed IssueFindings closed 3 years ago

IssueFindings commented 3 years ago

Hello, I try to configure the access to bitwarden through Nginx. When I test my Nginx configuration with https://www.immuniweb.com/websec/, I just get this error message : "PERMISSIONS-POLICY : The header is not properly set." and nothing more...

I don't understand my mistake in the code below : add_header Permissions-Policy "usb=(), geolocation=(), midi=(), notifications=(), push=(), sync-xhr=(self, https://haveibeenpwned.com, https://twofactorauth.org), microphone=(), camera=(), magnetometer=(), gyroscope=(), speaker=(), vibrate=(), fullscreen=(self), payment=()";

Anyone could you help me ?

Have a nice day.

BlackDex commented 3 years ago

@IssueFindings well looking in our code i see that we use the old draft name for this header, so maybe we need to add/update it to match the latest draft.

But in our code i see the following value for Feature-Policy, i think that if you copy that, it should work.

"accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; camera 'none'; encrypted-media 'none'; fullscreen 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; sync-xhr 'self' https://haveibeenpwned.com https://twofactorauth.org; usb 'none'; vr 'none'"

Also see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy Which states the same markup as in the code above instead of using =() as values.

IssueFindings commented 3 years ago

Sorry for the delay... and many thanks for your answer. Based on it, I update my Permissions-Policy as below add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(self 'https://haveibeenpwned.com' 'https://twofactorauth.org'), usb=(), vr=()";

That works even if an alert is displayed because of old Feature-Policy. That could be great to update your code ;-)

Again, many thanks !!