weaveworks / service

☁️ Images for Weave Cloud (R) (TM) (C) ☁️

https://cloud.weave.works

2 stars 2 forks source link

Security Umbrella Issue #1069

Closed tomwilkie closed 7 years ago

tomwilkie commented 7 years ago

Reported vulnerabilities:

[x] CSRF (~https://github.com/weaveworks/service/issues/2~ #1072)
[x] Click Jacking (https://github.com/weaveworks/service/issues/1062)
[x] Open Redirect (https://github.com/weaveworks/service/issues/1068)
[x] Oauth problem (#1081)
[x] Logout doesn't (https://github.com/weaveworks/service/issues/1064)
[x] Make cloud.weave.works https-only, and other Mozilla observatory stuff (https://github.com/weaveworks/service/issues/1106)

tomwilkie commented 7 years ago

Last item (CSP in #1106) is for @davkal, assigning to him.

jml commented 7 years ago

1204 fixed the last item of this.

jml commented 7 years ago

1204 was indeed merged, but isn't being run on dev or prod, so the security issue is still open.