Add some HTTP security-related headers - Githubissues

mcci-catena / docker-iot-dashboard

A complete IoT server for LoRaWAN IoT projects: node-red + influxdb + grafana + ssl + let's encrypt using docker-compose.

MIT License

101 stars 59 forks source link

Add some HTTP security-related headers #16

Closed oliv3 closed 6 years ago

oliv3 commented 6 years ago

Hi, This PR adds some HTTP headers that will raise the grade from F to B (Grafana), F to A (Node-Red) on https://securityheaders.com. Also, https://www.ssllabs.com now gives an A+. @terrillmoore There are still Referrer-Policy and Feature-Policy left to be defined, but those are kind of touchy. If you have any ideas, please let me know ! Regards,

terrillmoore commented 6 years ago

This looks good to me, thank you. You ready for me to merge?

oliv3 commented 6 years ago

Hi, please don't yet. Some last minutes changes to be fixed:

noticed the double Http Only rewrite for grafana cookies
also droping (my previously wrong) CSP header for Grafana sends back to B
also not sure if influxdb deserves all those headers ?
node red looks ok
had to add the cookie proxy pass rewrite for Grafana since that would break cookies for Traccar (the other app I'm adding right now, but no idea if this would be of interest to you) Basically it's not that urgent to merge this, better take some more time ?

oliv3 commented 6 years ago

Also noticed that using grafana/grafana:latest grabs 5.2.4, when 5.3.0 is available. Would not go using master neither, maybe 5.3 images are not yet available ?

terrillmoore commented 6 years ago

I'm willing to wait. No rush. I've not had a chance to run the ssllabs tests on this, so this is definitely important work.

oliv3 commented 6 years ago

@terrillmoore I think it's ok now !

ssllabs.com: A+
securityheaders.com:
- A+ for InfluxDB
- A for Grafana and Node-Red

terrillmoore commented 6 years ago

Thanks!

oliv3 commented 6 years ago

You're welcome ! Found a #ttn on freenode is this related to the project ?

terrillmoore commented 6 years ago

I'm not much involved with freenode (slack, etc., sort of fill my time) -- it's possible. #ttn is often used as the abbreviation for "The Things Network". There's much traffic at thethingsnetwork.org and on the global thingsnetwork slack; not sure if they also have a freenode group.

oliv3 commented 6 years ago

Religion forbids me using proprietary software :( And yes, there is a #ttn on freenode. 3 folks including me :)