upagekite/web: Add web security code

pagekite / upagekite

A simple PageKite connector and embedded HTTP daemon for MicroPython (on the ESP32 & more).

Other

15 stars 1 forks source link

upagekite/web: Add web security code #10

Open BjarniRunar opened 3 years ago

BjarniRunar commented 3 years ago

The micro-framework needs to support basic web security features by default.

A few ideas:

[x] A method which requires HTTP Basic auth (username/password)
[ ] An option on the above method to allow unauthenticated access from the LAN
[x] Easy-to-use CSRF in forms and the form parsing code
[x] Review what kind of CORS headers should be included by default
[x] Use default Referrer-policy to not leak domains/URLs to outside
[x] Set cache-control defaults to "private" only

BjarniRunar commented 2 years ago

I think the conclusion w.r.t. CORS is no headers should be added by default, since CORS is designed to grant further access, not restrict it. Apps which need this can however change the defaults or add their own CORS headers. So marking that task done.