search

daurnimator / lua-http

HTTP Library for Lua. Supports HTTP(S) 1.0, 1.1 and 2.0; client and server.
https://daurnimator.github.io/lua-http/
MIT License
778 stars 80 forks source link

New default TLS options #216

Open bigben93 opened 10 months ago

bigben93 commented 10 months ago

I tested default settings of lua-http server with testssl command. The worst problems:

Testing protocols via sockets except NPN+ALPN

SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 offered (deprecated) TLS 1.1 offered (deprecated) TLS 1.2 offered (OK) TLS 1.3 offered (OK): final NPN/SPDY not offered ALPN/HTTP2 h2, http/1.1 (offered)

and

Testing vulnerabilities [...] Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), DoS threat [...]

To fix these problems HTTPS server must be run with additional TLS flags: OP_NO_TLSv1, OP_NO_TLSv1_1, OP_NO_RENEGOTIATION.

I think it would be a good idea to provide better security "out of the box".

daurnimator commented 10 months ago

See https://github.com/daurnimator/lua-http/pull/217