Tasks identified during the 2019 Vulnerability Assessment for Community Analytics

hmitsch commented 5 years ago

Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1434962

Everything looks good, these headers should be implemented:

-20 cookies Anti-CSRF tokens set without using the SameSite flag.
-20 x-frame-options X-Frame-Options (XFO) header not implemented.
-5 subresource-integrity Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS.
-5 x-content-type-options X-Content-Type-Options header not implemented.

Remark: If these headers can't be added to GrimoireLab, we can also add them to the IAM Proxy.

gdestuynder commented 5 years ago

It would be great to have them in https://github.com/mozilla-iam/mozilla.oidc.accessproxy as an option as it'll help more sites (ie the iam proxy)

canasdiaz commented 5 years ago

Hi @gdestuynder , for a new instance recently deployed we are using a different proxy named keycloak/keycloak-gatekeeper. I wonder whether the situation would be improved if we start using it also for analytics.mozilla.community.

In the meantime, what do u need from us (Bitergia)?

gdestuynder commented 5 years ago

keycloack-gatekeeper is also a fine option

mozilla / participation-metrics-org

Tasks identified during the 2019 Vulnerability Assessment for Community Analytics #187