search

nextcloud / server

☁️ Nextcloud server, a safe home for all your data
https://nextcloud.com
GNU Affero General Public License v3.0
26.63k stars 3.99k forks source link

`Feature-Policy` should be called `Permissions-Policy` now, having a bit different syntax #22792

Open kroko opened 3 years ago

kroko commented 3 years ago

Is your feature request related to a problem? Please describe.

Permissions Policy, W3C Working Draft, 16 July 2020 specifies that Feature-Policy is now called Permissions Policy.

If Nextcloud implements these headers they should be kept up to date.

Describe the solution you'd like

At

https://github.com/nextcloud/server/blob/be9dde8a074117833ce7f0252ac8784146c8a9fc/lib/public/AppFramework/Http/Response.php#L243

Permissions-Policy should be generated instead of Feature-Policy.
Permissions-Policy has slightly different syntax.

Describe alternatives you've considered

Both Permissions-Policy and Feature-Policy are generated.

Additional context

securityheaders.com post on the topic - Goodbye Feature Policy and hello Permissions Policy!

Thanks!

kowalcj0 commented 3 years ago

This change would be a nice security touch. I'd bump some of the automated security check scores to a higher grade. Here's an example report for the demo site: https://securityheaders.com/?q=https%3A%2F%2Fdemo2.nextcloud.com%2Findex.php%2Flogin%3Fuser%3D43peHHrPx6rJg7Xq&hide=on&followRedirects=on

nursoda commented 3 years ago

Mind that client support may still be inferior:

Latest (editors) draft version (2020-09-29): https://w3c.github.io/webappsec-permissions-policy/

BrodyStone21 commented 2 years ago

So are we just going to keep removing this from the milestones and then readding it? Is this going to be implemented soon?

solracsf commented 2 years ago

Pull Requests are very welcome.

tohn commented 2 years ago

It seems that there is already a PR: https://github.com/nextcloud/server/pull/23825

Xyz00777 commented 2 weeks ago

Hi im checking the security of my nextcloud instance and it looks like its still sadly still not implemented :( is there any new information when it will come?

joshtrichards commented 6 days ago

@Xyz00777 If there was, it would be here in this issue. There was an earlier start in #23825 to implement it, but needs someone to pick it up to get it across the finish line. You feel like giving making an attempt at a revised implementation?

Note that this is basically a cosmetic (rename + minor syntax differences) change. There isn't a security difference AFAIK (but we should still address it).

Xyz00777 commented 3 days ago

thanks for the reply, but im just an learned sys admin and dont have nearly enough experience to help with developement doings (sadly, would really like to help in some projects :/ )