search

plone / plone.protect

HTTP protection utilities for the Plone CMS
https://pypi.org/project/plone.protect/
7 stars 8 forks source link

Add support for X-Xss-Protection and X-Content-Type-Options response headers #82

Open hvelarde opened 6 years ago

hvelarde commented 6 years ago

refs. https://github.com/plone/Products.CMFPlone/issues/2494

hvelarde commented 6 years ago

@plone/framework-team this is ready for review; I don't know if the @plone/security-team needs to take a look at it also.

hvelarde commented 6 years ago

@plone/testing-team I don't know why the job didn't finish.

gforcada commented 6 years ago

@hvelarde it clearly says at the end of the output https://jenkins.plone.org/job/pull-request-5.2/1096/console that there is a timeout limit (set to 180 minutes) and it was reached.

Why it did reach that limit... good question.

hvelarde commented 6 years ago

seems this test is failing:

https://github.com/plone/Products.ATContentTypes/blob/master/Products/ATContentTypes/tests/http_access.txt#L335-L345

hvelarde commented 6 years ago

thanks! fixing the ATContentTypes test seems easy, but I haven't had time for that neither.

jensens commented 4 years ago

Hence there was no activity for a long time, I propose to close this PR within next two weeks. If you do not feel OK with this, please speak up and provide us a rough schedule.

yurj commented 2 years ago

meanwhile, X-XSS-Protection is not used aymore, now we should use CSP. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Rudd-O commented 2 years ago

Could we shape this PR up to current standards? This looks useful and I'm tired of having to set these headers in Varnish.

jensens commented 1 year ago

@Rudd-O Is this something you plan to work on?