Security Compliance with Mozilla Observatory

eikek / sharry

Sharry is a self-hosted file sharing web application.

https://eikek.github.io/sharry

GNU General Public License v3.0

861 stars 54 forks source link

Security Compliance with Mozilla Observatory #1435

Open DaCHack opened 3 months ago

DaCHack commented 3 months ago

Hi @eikek ,

thanks for this Great tool!

Just a quick question: Did you check the webinterface against https://observatory.mozilla.org/ ? It gave me a couple of potential findings. Not all of them are relevant since eg HSTS is irrelevant if you use sharry behind a reverse proxy like traefik. Nonetheless, the tools look to me like a good source to increase security.

what do you think of these findings and are you Planning to close some of the gaps?

Many thanks!

eikek commented 3 months ago

Hi @DaCHack thanks for the suggestion. I don't plan to specifically address these things in Sharry itself. Most of it can be implemented by a reverse proxy, so people can do just that. If there code changes necessary in Sharry, let me know about the specifics and then I'll see (and usually I'm happy to do it eventually). For my personal case many of that is not important to me and I don't have too much free time available.