Update/Add security headers #280

max-debug022 · 2024-06-26T14:54:58Z

This PR improves/updates the HTTP-Headers

TLDR

Update helmet to 7.1.0 in API and Admin
Coherent CORS-Policy (Cross-Origin-Ressource-Sharing) for the API -> to Admin & Site
Coherent CORP/COEP (Cross-Origin-Ressource/Embedder-Policy) for API, Admin & Site
Strict COOP (Cross-Origin-Opener-Policy) for API, Admin & Site
Removal of deprecated, redundant, or prohibited headers
CSP (Content Security Policy) that enforces the JEA (just enough access) principle

This PR implements the "Just-Enough-Access" (JEA) security strategy, ensuring that only necessary privileges are granted while restricting all others. The PR includes a coherent CORS policy so that resources can only be shared within the microservices. Additionally, CORP/COEP have been enforced to control resource access and embedding to authorized origins only. Several Content Security Policy (CSP) errors have been resolved & unnecessary privileges have been removed - Admin has slightly more flexibility than the Site. Reasons for several changes:

Update helmet to v7.1.0
CORS uses now a maxAge of 600s as Chromium (prior to v76) caps at 10mins
CORP only for Same-Site
Set COOP for same-origin
Remove the empty exposedHeaders field as it is the default
Disable unused x-powered-by header
Disable deprecated X-XSS-Protection Header
Disable deprecated X-Frame-Options Header
Enable HSTS with recommended values
Disable Referrer Policy
...

thomasdax98 · 2024-07-01T07:36:33Z

Did you test this in one of our projects in a deployed setting? I fear that there might be some unwanted side-effects relating to different domains in a deployed setting

max-debug022 · 2024-07-01T07:43:34Z

Did you test this in one of our projects in a deployed setting? I fear that there might be some unwanted side-effects relating to different domains in a deployed setting

Yes, I tested it on deployed settings.

dkarnutsch · 2024-07-01T08:38:22Z

Did you test this in one of our projects in a deployed setting? I fear that there might be some unwanted side-effects relating to different domains in a deployed setting

I would not add this to existing projects without extensive testing. However, the starter can define best practices and hopefully all bugs are discovered during development. So I think it is relatively safe to merge this.

dkarnutsch · 2024-07-01T08:39:41Z

Some header could possible have a comment, when to extend/change them.

You could also add links to best practices (MDN?), so we can track changes.

max-debug022 · 2024-07-01T10:26:24Z

Some header could possible have a comment, when to extend/change them.

You could also add links to best practices (MDN?), so we can track changes.

Luckily I originally added comments to each Header but removed them since I wasn't sure if comments should be in the code. I could add them again, but I think it would be better to add detailed docs on how to modify each header and what effect each header has. What would you prefer?

dkarnutsch · 2024-07-01T10:46:27Z

Some header could possible have a comment, when to extend/change them.
You could also add links to best practices (MDN?), so we can track changes.

Luckily I originally added comments to each Header but removed them since I wasn't sure if comments should be in the code. I could add them again, but I think it would be better to add detailed docs on how to modify each header and what effect each header has. What would you prefer?

In code, as documentation can drift away. @johnnyomair?

johnnyomair · 2024-07-04T14:28:36Z

Some header could possible have a comment, when to extend/change them.
You could also add links to best practices (MDN?), so we can track changes.

Luckily I originally added comments to each Header but removed them since I wasn't sure if comments should be in the code. I could add them again, but I think it would be better to add detailed docs on how to modify each header and what effect each header has. What would you prefer?

In code, as documentation can drift away. @johnnyomair?

Agreed. We could add line comments for each header/item.

site/next.config.js

admin/server/server.js

api/src/app.module.ts

thomasdax98 · 2024-07-07T14:31:11Z

site/next.config.js

+                        "style-src-elem 'unsafe-inline'",
+                        "style-src-attr 'unsafe-inline'",
+                        `img-src 'self' data: ${process.env.API_URL}/`,
+                        "script-src 'unsafe-eval'",


Why do we allow 'unsafe-eval' for scripts? Isn't that potentially dangerous? Or is it required by Next?

Unfortunately, it seems like it is required by one of our dependencies.

Can we specify which dependency? As far as I know Tag Managers require this value, but we don't have one as hard dependency. Nevertheless we might assume that a Tag Manager will be used most of the time.

Well, it's a lot; and I do not know an efficient way to evaluate it (even with tools like bundle-analyzer). Just because a package contains eval or any other "unsafe-eval" code doesn't necessarily mean the CSP needs to permit it. We have hundreds of files (including package dependencies oc) that include some form of eval.

A few example-deps are:

exceljs

protobufjs

next.js

terser-webpack-plugin

uglify-js

There are many others, particularly code minifiers, TypeScript dependencies, and linting libraries. Has anyone suggestions on a more effective way to evaluate this?

Has anyone suggestions on a more effective way to evaluate this?

I'd probably set it to 'none', start the site and see where an error occurs.

exceljs

I doubt that we have this dependency in the site

I'd probably set it to 'none', start the site and see where an error occurs.

That's what I did in the first place, but the error messages are generic and rarely inform you about the specific package.

I doubt that we have this dependency in the site

Yes, sorry - I forgot to mention that I included all microservices since we not only use the CSP in the site, (although API wouldn't be necessary I guess).

We can have a look at it together the next time we're both in the office.

site/next.config.js

api/src/main.ts

max-debug022 · 2024-07-08T07:53:59Z

Agreed. We could add line comments for each header/item.

@johnnyomair what headers should be documented and how? I don't think an explanation is useful since anyone can look headers up and they are fairly well explained. And if you understand the header you probably understand the logic behind their value.

For example. x-xss-protection - the first thing in the MDN docs is that it should not be used, so its value is false.

Edit: My initial documentation was somewhat like this:

app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "default-src": ["'none'"], // No external resources are needed
      },
      useDefaults: false, // Disable all other default CSP rules
    },
    xXssProtection: false, // Disable deprecated header
    xFrameOptions: false, // Disable deprecated header
    crossOriginResourcePolicy: "same-origin", // Do not allow cross-origin requests to access the response
    crossOriginEmbedderPolicy: true, // =no-corp Enable COEP
    crossOriginOpenerPolicy: true, // =same-origin Enable COOP
    strictTransportSecurity: {
      // Enable HSTS
      maxAge: 63072000, // 2 years (recommended if including subdomains)
      includeSubDomains: true, // Include all subdomains
      preload: true, // Enable HSTS preload
    },
    referrerPolicy: {
      policy: "no-referrer", // No referrer information needs to be sent
    },
    xContentTypeOptions: true, // = nosniff
    xDnsPrefetchControl: false, // Disable non-standard header as recommended by MDN
    xDownloadOptions: true, // = noopen (forces IE8+ not to open files in the context of the page but instead download them)
    xPermittedCrossDomainPolicies: true, // = none (prevent the browser from MIME-sniffing)
    originAgentCluster: true, // = false (disables the agent cluster)
  }),
);

thomasdax98 · 2024-07-08T09:06:24Z

Edit: My initial documentation was somewhat like this:

app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "default-src": ["'none'"], // No external resources are needed
      },
      useDefaults: false, // Disable all other default CSP rules
    },
    xXssProtection: false, // Disable deprecated header
    xFrameOptions: false, // Disable deprecated header
    crossOriginResourcePolicy: "same-origin", // Do not allow cross-origin requests to access the response
    crossOriginEmbedderPolicy: true, // =no-corp Enable COEP
    crossOriginOpenerPolicy: true, // =same-origin Enable COOP
    strictTransportSecurity: {
      // Enable HSTS
      maxAge: 63072000, // 2 years (recommended if including subdomains)
      includeSubDomains: true, // Include all subdomains
      preload: true, // Enable HSTS preload
    },
    referrerPolicy: {
      policy: "no-referrer", // No referrer information needs to be sent
    },
    xContentTypeOptions: true, // = nosniff
    xDnsPrefetchControl: false, // Disable non-standard header as recommended by MDN
    xDownloadOptions: true, // = noopen (forces IE8+ not to open files in the context of the page but instead download them)
    xPermittedCrossDomainPolicies: true, // = none (prevent the browser from MIME-sniffing)
    originAgentCluster: true, // = false (disables the agent cluster)
  }),
);

@max-debug022 I like this. During the review I had a hard time wrapping my head around "What does true (or false) mean in this case?"

I think you should add these comments

max-debug022 · 2024-07-08T10:12:59Z

I added the comments: cbc0472

johnnyomair · 2024-07-09T13:33:03Z

@johnnyomair what headers should be documented and how? I don't think an explanation is useful since anyone can look headers up and they are fairly well explained. And if you understand the header you probably understand the logic behind their value.

I'd add comments for all settings that aren't obvious.

Also, I'd only change the headers if they differ from helmets default value.

site/next.config.js

max-debug022 · 2024-08-01T11:28:07Z

@thomasdax98 @fraxachun @thomasdax98 @johnnyomair

admin/server/server.js

… local development

johnnyomair

Please fix the lint workflow

johnnyomair · 2024-10-22T05:55:34Z

@dkarnutsch @fraxachun @thomasdax98 please review, this one's been open for way too long 😁

site/next.config.js

johnnyomair · 2024-10-28T10:18:03Z

site/next.config.js

@@ -5,6 +5,31 @@ const withBundleAnalyzer = require("@next/bundle-analyzer")({
    enabled: process.env.ANALYZE === "true",
 });

+function generateCSP() {


headers already is a function, so why not move the code there before returning the array?

fraxachun · 2024-10-28T12:37:23Z

site/next.config.js

+        cspRules["script-src"] = "'unsafe-eval'"; // Needed in local development
+        cspRules["connect-src"] = "ws:"; // Used for hot reloading in local development
+    } else {
+        cspRules["upgrade-insecure-requests"] = ""; // Don't use upgrade-insecure-requests with Domain-Setup


Why do we need this at all?

This instructs user agents to treat a site's insecure URLs (HTTP) as though they have been replaced with secure URLs.

Yes, but why do we need it? We don't serve any routes prefixed with http in our applications or do we?

Including upgrade-insecure-requests is optional but helps avoid potential misconfigurations and adds an extra layer of security, so I’d recommend keeping it.

max-debug022 · 2024-11-05T15:39:43Z

I will wait for this PR to be merged: #415

auto-assign bot requested review from dkarnutsch, fraxachun, johnnyomair, nsams and thomasdax98 June 26, 2024 14:55

auto-assign bot assigned max-debug022 Jun 26, 2024

max-debug022 requested a review from mennoxx June 27, 2024 07:52

nsams removed their request for review June 27, 2024 08:46

johnnyomair reviewed Jul 4, 2024

View reviewed changes

site/next.config.js Outdated Show resolved Hide resolved

thomasdax98 reviewed Jul 7, 2024

View reviewed changes

site/next.config.js Outdated Show resolved Hide resolved

api/src/main.ts Outdated Show resolved Hide resolved

thomasdax98 previously approved these changes Jul 9, 2024

View reviewed changes

johnnyomair reviewed Jul 11, 2024

View reviewed changes

site/next.config.js Outdated Show resolved Hide resolved

site/next.config.js Show resolved Hide resolved

max-debug022 dismissed thomasdax98’s stale review via a7ca85f July 19, 2024 09:32

johnnyomair previously approved these changes Jul 22, 2024

View reviewed changes

max-debug022 dismissed johnnyomair’s stale review via 8fc1a07 August 1, 2024 11:21

max-debug022 force-pushed the security-header-jea branch from a7ca85f to 8fc1a07 Compare August 1, 2024 11:21

dkarnutsch reviewed Aug 5, 2024

View reviewed changes

admin/server/server.js Outdated Show resolved Hide resolved

max-debug022 added 8 commits October 8, 2024 12:38

Disable x-powered-by header

55b7a7c

Add upgrade-insecure-requests to Site

8e3b2a0

Add check for DEV_DOMAIN

677eed6

Allow unsafe-inline for script-src-elem to prevent preview error

23e6f72

Remove unused import

a2d158b

Only use upgrade-insecure-requests if not in local development

20e8a1a

Update package-lock after rebase

808d521

Improve dokumentation and further restrict csp

057701e

max-debug022 force-pushed the security-header-jea branch from d2311e6 to 057701e Compare October 8, 2024 10:44

Merge branch 'main' into security-header-jea

0ca51f1

johnnyomair force-pushed the security-header-jea branch from e342490 to 0ca51f1 Compare October 15, 2024 06:39

Remove script-src unsafe-eval for production as it is only needed for…

d2578b0

… local development

max-debug022 requested review from johnnyomair, thomasdax98 and dkarnutsch October 16, 2024 10:38

max-debug022 added 3 commits October 16, 2024 13:02

Merge branch 'main' into security-header-jea

134517b

Add unknown words to project-words.txt

c78572c

Move words to site

ba88882

johnnyomair requested changes Oct 17, 2024

View reviewed changes

johnnyomair removed the request for review from mennoxx October 17, 2024 11:14

Move words to api

4040de6

johnnyomair previously approved these changes Oct 22, 2024

View reviewed changes

fraxachun requested changes Oct 22, 2024

View reviewed changes

site/next.config.js Show resolved Hide resolved

site/next.config.js Outdated Show resolved Hide resolved

site/next.config.js Outdated Show resolved Hide resolved

max-debug022 added 2 commits October 28, 2024 08:25

Explicitly allow only the admin to embed site as iframe

e7050c5

Add generate CSP function to improve readability

42a5ebf

max-debug022 dismissed johnnyomair’s stale review via 42a5ebf October 28, 2024 07:45

johnnyomair reviewed Oct 28, 2024

View reviewed changes

fraxachun reviewed Oct 28, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update/Add security headers #280

Update/Add security headers #280

max-debug022 commented Jun 26, 2024 •

edited

Loading

thomasdax98 commented Jul 1, 2024

max-debug022 commented Jul 1, 2024

dkarnutsch commented Jul 1, 2024

dkarnutsch commented Jul 1, 2024 •

edited

Loading

max-debug022 commented Jul 1, 2024 •

edited

Loading

dkarnutsch commented Jul 1, 2024

johnnyomair commented Jul 4, 2024

thomasdax98 Jul 7, 2024

max-debug022 Jul 8, 2024

fraxachun Aug 6, 2024

max-debug022 Sep 10, 2024

johnnyomair Sep 10, 2024

max-debug022 Sep 10, 2024 •

edited

Loading

johnnyomair Sep 11, 2024

max-debug022 commented Jul 8, 2024 •

edited

Loading

thomasdax98 commented Jul 8, 2024

max-debug022 commented Jul 8, 2024

johnnyomair commented Jul 9, 2024

max-debug022 commented Aug 1, 2024

johnnyomair left a comment

johnnyomair commented Oct 22, 2024

johnnyomair Oct 28, 2024

fraxachun Oct 28, 2024

max-debug022 Oct 30, 2024

fraxachun Oct 30, 2024

max-debug022 Nov 5, 2024

max-debug022 commented Nov 5, 2024

Update/Add security headers #280

Are you sure you want to change the base?

Update/Add security headers #280

Conversation

max-debug022 commented Jun 26, 2024 • edited Loading

This PR improves/updates the HTTP-Headers

thomasdax98 commented Jul 1, 2024

max-debug022 commented Jul 1, 2024

dkarnutsch commented Jul 1, 2024

dkarnutsch commented Jul 1, 2024 • edited Loading

max-debug022 commented Jul 1, 2024 • edited Loading

dkarnutsch commented Jul 1, 2024

johnnyomair commented Jul 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

max-debug022 Sep 10, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

max-debug022 commented Jul 8, 2024 • edited Loading

thomasdax98 commented Jul 8, 2024

max-debug022 commented Jul 8, 2024

johnnyomair commented Jul 9, 2024

max-debug022 commented Aug 1, 2024

johnnyomair left a comment

Choose a reason for hiding this comment

johnnyomair commented Oct 22, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

max-debug022 commented Nov 5, 2024

max-debug022 commented Jun 26, 2024 •

edited

Loading

dkarnutsch commented Jul 1, 2024 •

edited

Loading

max-debug022 commented Jul 1, 2024 •

edited

Loading

max-debug022 Sep 10, 2024 •

edited

Loading

max-debug022 commented Jul 8, 2024 •

edited

Loading