search

github / secure_headers

Manages application of security headers with many safe defaults
MIT License
3.17k stars 252 forks source link

Add report-to CSP directive #529

Open loremotta33 opened 1 month ago

loremotta33 commented 1 month ago

I added the secure_headers gem to my project as we needed to implement CSP. When configuring the policy, I was going to add the report-to directive as it seems that report-uri has been deprecated. I noticed that the gem does not have support for this configuration so decided to add it.

All PRs:

Adding a new CSP directive

Is the directive supported by any user agent? If so, which?

Yes, it's supported by all main browsers except Firefox.

What does it do?

It's used to indicate the name of the endpoint that the browser should use for reporting CSP violations. Intends to replace deprecated report-uri directive. Browsers should fallback tho report-uri if report-to not supported, so it's recommended to set both directives.

An array of endpoints is supported. But if more than one endpoint is provided, browser will default to use the first one. I added it to report-uri to preserve the scheme, as as far as I checked, there is no restriction on the naming of the endpoint.

This directive is directly tied to the Reporting-Endpoints HTTP header, at the moment on my project I'm manually adding the Reporting-Endpoints header through the Rails default_headers configuration, I do not know if managing this header through the gem is something on the scope of the gem.

Here is the specification for report-to.

rzhade3 commented 4 weeks ago

Hi @loremotta33, thanks so much for this PR! This looks like a worthy change to upstream, however I just have some confusion around how exactly we should support this directive in the library.

It looks like to support this directive, we'll also need to support the Report-Endpoints header? However, this header is not supported in Safari or Opera? I'm slightly worried about causing confusion amongst users of our library due to incompatibility in these browsers; although ultimately given the status of Report-To as an accepted CSP directive, this is a good change.

loremotta33 commented 3 weeks ago

That's a great catch @rzhade3, I have not noticed that the report-to browser compatibility table is different than the Reporting-Endpoints one.

I'm not sure if the tables are correct or up to date though, as I just downloaded the latest Opera version (114.0.5282.115), and it has used the Endpoint defined on the Reporting-Endpoints header to report the CSP violation (screenshot attached).

image

If you think it makes sense to add support to the Reporting-Endpoints header through the gem let me know and I can take a look to the code to do so!

I thought of initially adding support for it on this Pull Request but I was not sure if it was something that would be wanted or not for the gem

rzhade3 commented 2 weeks ago

@loremotta33 Thanks for doing that research! Given that it is strictly needed to implement Reporting-Endpoints in order for report-to to be respected by a browser, let's try and add that to this PR! Can you take a look at whether you're able to implement that?

loremotta33 commented 6 days ago

@rzhade3 , sorry for the delay on this, I have been pretty busy the last days.

I just pushed a commit to add Reporting-Endpoints support, did some testings myself and I think that it's working as expected, but let me know if some extra work is needed for this!