Open arroway opened 4 years ago
I did run of our staging server on Mozilla Observatory and ssltest, I found the following issues:
They report that some CSP properties are missing, but I see them. So maybe we don't specify them properly. I'll look into that.
I think this happens because we don't specify them on error. I'll fix that.
Here are the hosting-related concerns, that I'll check with the hosting team:
X-Forwarded-For
. Nginx can use this module: ngx_http_realip_module. If we have several reverse proxies before nginx we may need to configure real_ip_recursive
to on
. bug 1638038X-Forwarded-For
to the service. bug 1638039Added problem on May 13 after running api.profiler.firefox.com through mozilla observatory:
https://prod.firefoxprofiler.prod.cloudops.mozgcp.net//
. Following the checklist in https://infosec.mozilla.org/guidelines/web_security we should just disable the http endpoint. Bug 1638041
Risk Management
Infrastructure
strict-transport-security: max-age=31536000
services.mozilla.com
, it must be manually added to Firefox's preloaded pins. This only applies to production services, not short-lived experiments.X-Forwarded-For
to all back-end services.Development
pip list --outdated
or requires.io or pyup outdated checkscargo update
and cargo upgrade when changing versionsDual Sign Off
Logging
Web Applications
/__cspreport__
endpointdefault-src 'none'; frame-ancestors 'none'; base-uri 'none'; report-uri /__cspreport__
to disallowing all content rendering, framing, and report violationsnone
, frame-src, and object-src should benone
or only allow specific originsSecurity Features
extensions.webextensions.restrictedDomains
. This will prevent a malicious extension from being able to steal sensitive information from it, see bug 1415644.Databases
Common issues
target="_blank"
in external links unless you also userel="noopener noreferrer"
(to prevent Reverse Tabnabbing)