search

hsetiawan / owasp-esapi-java

Automatically exported from code.google.com/p/owasp-esapi-java
Other
0 stars 0 forks source link

Need a new filter for browser security response headers #169

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
We need one central filter for security headers (clickjacking headers, XSS 
header defense, STS and others) 

http://feedproxy.google.com/~r/typepad/the_security_practice/~3/aMQ-E8zZYk4/the-
need-for-coherent-web-security-policy-frameworks.html

Let's work out the API first for each header, and then make it work as a global 
configurable filter.

Original issue reported on code.google.com by manico.james@gmail.com on 3 Nov 2010 at 5:40

Attachments:

GoogleCodeExporter commented 9 years ago 
Issue 167 has been merged into this issue.

Original comment by manico.james@gmail.com on 3 Nov 2010 at 5:42

GoogleCodeExporter commented 9 years ago 
Issue 53 has been merged into this issue.

Original comment by manico.james@gmail.com on 3 Nov 2010 at 5:43

GoogleCodeExporter commented 9 years ago

Original comment by manico.james@gmail.com on 3 Nov 2010 at 5:45

GoogleCodeExporter commented 9 years ago 
(From Sebastian)

One way to avoid SRP violation would be that you have
a Filter called BrowserAidFilter and that calls some
classes implementing the interface BrowserAid.
And you could make it configurable which BrowserAid
is active and users could write their own Aids
if they need to. So in a way,
you create a browser medicine cabinet. :-)

Original comment by manico.james@gmail.com on 3 Nov 2010 at 9:43

GoogleCodeExporter commented 9 years ago

Original comment by manico.james@gmail.com on 29 May 2012 at 3:19

GoogleCodeExporter commented 9 years ago 
Hi I was looking at this code since I am still using "old" Spring-Security 
3.1.3-RELEASE, and there are not yet implemented those filters.

I'm wondering if I got this correctly:

There are two private properties, (lines 63 and 64)
boolean enable = true;
boolean block = false;

and then another pair of same in init() method (lines 74 and 75)

Then method doFilter() use state of these properties, but since 74 and 75 are 
local properties it never overrides those from lines 63 and 64.

Am I correct?

Thnx

Original comment by stal...@gmail.com on 28 May 2014 at 6:55

GoogleCodeExporter commented 9 years ago 
The ESAPI Web Application Firewall (WAF) can already handle this with the 
add-header rule.

Original comment by justinas...@gmail.com on 26 Jan 2015 at 6:30