Enforce security-related HTTP response headers recommended by https://observatory.mozilla.org/

[nodiscc]

In ApiMiddleware.php, Shaarli sets a few HTTP response headers ( Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Origin). We could augment this list with security-related HTTP headers recommended by https://observatory.mozilla.org/, and add these headers to all Shaarli HTTP responses (not only the API).

A vanilla Shaarli installation should pass most tests from the observatory, with minimal configuration required on the webserver side.

For instance we are missing the Content-Security-Policy header - I use to set a default, restrictive CSP at the webserver level but this is not documented - then it must be relaxed specifically for this plugin.

[nodiscc]

https://observatory.mozilla.org/analyze/demo.shaarli.org

Rating: D
Score: 35/100
Tests Passed: 6/11

[hydrargyrum]

Since the web app does not require external resources, the CSP header could be set to something like default-src 'self', right? Maybe it should require 'unsafe-inline' too.

[nodiscc]

I have it set to "script-src 'self' 'unsafe-inline' https://www.youtube.com https://s.ytimg.com; frame-ancestors 'none'", youtube URLs are only needed for the playvideos plugin.

I have not tried to replace script-src with default-src

[thican]

Hello,

I think we should make a list of CSP violations for a default CSP with script-src 'self'; and style-src 'self'; so we can answer those issues. Using sources like unsafe-inline defeat the whole purpose of CSP.
Note: I personally added exceptions with source https://* for img-src and media-src, useful for external thumbnails and such.

I have a question about the vintage theme, is it still supported? I see multiple inline javascript contents, but I am not sure if we should fix them.

I also confirm my web browser reports violation with plugin playvideos but it looks like the issue comes from the jquery file shipped within this plugin, version 1.11.2 which seems quite old.
Shouldn’t we try to update it to see if this answers this CSP violation?

About style-src, the only place I see a violation is in the cloud tags page.
After reflection, nonce is not the best solution IMHO, as it requires to set CSP header which is not the case yet, and then removes the possibility to let the web host to set this header.
Class with exhaustive list of values in a dynamic CSS file could be a solution.

[nodiscc]

make a list of CSP violations for a default CSP with script-src 'self'; and style-src 'self';

👍

the vintage theme, is it still supported?

I wouldn't bother fixing those issues for the vintage theme right now, unless you use it personally.

Shouldn’t we try to update [playvideos jquery file]

Worth trying, and checking if that resolves CSP issues (and if the plugin still works with an updated jquery)

[thican]

Hello,

Thanks for the merging of #2103.
About the vintage theme, no I don’t use it. Also I guess it should have the same level of quality than the default theme since it is shipped by the project; hence my question.

About the Content-Security-Policy that I use, I updated it a bit:
default-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self'; font-src 'self'

This won’t work (currently) for the playvideos module since this one uses Youtube’s content, as already mentioned in its documentation.
Its jQuery and documentation about CSP should be updated to avoid an unsafe policy.

And I guess that’s it, which is pretty good news.

[thican]

I tested the plugin playvideos with only modifying the host’s CSP, it works.
As modifications:

• for script-src, adding https://www.youtube.com (i.e script-src 'self' https://www.youtube.com;);
• for frame-src, adding https://www.youtube.com (i.e frame-src 'self' https://www.youtube.com;).

Full value:
default-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; script-src 'self' https://www.youtube.com ; connect-src 'self'; frame-src 'self' https://www.youtube.com; img-src 'self'; style-src 'self'; font-src 'self'

I still see in the console one CSP violation with jQuery version 1.11.2, however with jQuery 3.7.1, this message is gone.