Set hardening headers - Githubissues

theupdateframework / theupdateframework.io

Website assets for TUF

5 stars 17 forks source link

Set hardening headers #11

Closed adityasaky closed 2 years ago

adityasaky commented 3 years ago

For TUF to complete the requirements using https://theupdateframework.io/ for the CII Best Practices Gold badge, it must include certain hardening headers. They are:

Content Security Policy (CSP)
HTTP Strict Transport Security (already set)
X-Content-Type-Options (as "nosniff")
X-Frame-Options

I'm looking at the headers using https://securityheaders.com/?q=https%3A%2F%2Ftheupdateframework.io&followRedirects=on and the requirements for the gold badge criteria can be found at https://bestpractices.coreinfrastructure.org/en/projects/1351?criteria_level=2#hardened_site.

lukpueh commented 2 years ago

Fixed in #32