Feature #7805
Add several security related HTTP headers - security hardening.
Description
Several HTTP headers that enhance security on client-side:
Content Security Policy
HTTP Strict Transport Security
X-XSS-Protection
X-Frame-Options
X-Content-Type-Options All of these enable browser protections on client side and make exploitation of common web flaws harder.
Adding these should be considered security hardening.
Related issues
History
#1
Updated by Lukas Zapletal over 8 years ago
- Category set to Security
Hello,
can you tell those all work with Foreman? I think we can't use all of them, because of noVNC, but some might be good indeed.
If you run your Foreman instance via Apache, then you can easily add them and report to us which of these have worked. Thanks!
#2
Updated by Daniel Lobato Garcia over 8 years ago
- Pull request https://github.com/theforeman/foreman/pull/1779 added
- Pull request deleted (
)
#3
Updated by Dominic Cleal over 8 years ago
- Status changed from New to Ready For Testing
- Assignee set to Jan Rusnacko
- Target version set to 1.7.2
#4
Updated by Anonymous over 8 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset 5c50ca8efb2bfa414e7e4184db153dfcc31c2cd2.
#5
Updated by Ohad Levy over 8 years ago
- Related to Bug #7907: gravatars are now broken added
#6
Updated by Daniel Lobato Garcia over 8 years ago
- Legacy Backlogs Release (now unused) set to 21
#7
Updated by Dominic Cleal over 8 years ago
- Related to Bug #7985: Can not access server console added
#8
Updated by Dominic Cleal over 8 years ago
- Related to Bug #7018: SPICE libvirt websockets connections aren't encrypted added
fixes #7805 - Add several security related HTTP headers - security hardening.
This commit uses secure_headers gem and configures several HTTPsecurity related headers to be sent by server:
All of these enable browser protections on client side and make
exploitation of common web flaws harder.