Implement modern web security standards

jellyfin / jellyfin.org

The Jellyfin website, blog, and user documentation

http://jellyfin.org

Other

85 stars 324 forks source link

Implement modern web security standards #375

Open randomhydrosol opened 1 year ago

randomhydrosol commented 1 year ago

The following security features aren't implemented for the website and should be: HTTP strict transport security (HSTS) with preloading Strong CSP Security headers: x-content-type-options x-frame-options Explicitly disable xss auditor

masterflitzer commented 3 months ago

just some minor considerations:

x-frame-options is obsoleted by the frame-ancestors directive in CSP (see)
x-xss-protection should absolutely not be used anymore, even explicitly disabling it can create vulnerabilities in legacy browsers and it doesn't do anything in modern browsers because support has been removed, the alternative is to not allow unsafe-inline in CSP (see)

so i'd remove this from your comment:

x-frame-options Explicitly disable xss auditor