mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #21630 from owncloud/add-some-security-headers-as-hardening 

Add X-Download-Options and X-Permitted-Cross-Domain-Policies
This commit is contained in:
Thomas Müller 2016-01-13 10:33:58 +01:00
parent 5565b19382 4d0dcd3c53
commit b1ee51f255
4 changed files with 45 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.htaccess
View File

@ -12,6 +12,8 @@
Header set X-XSS-Protection "1; mode=block" Header set X-XSS-Protection "1; mode=block"
Header set X-Robots-Tag "none" Header set X-Robots-Tag "none"
Header set X-Frame-Options "SAMEORIGIN" Header set X-Frame-Options "SAMEORIGIN"
Header set X-Download-Options "noopen"
Header set X-Permitted-Cross-Domain-Policies "none"
SetEnv modHeadersAvailable true SetEnv modHeadersAvailable true
</IfModule> </IfModule>

4
core/js/setupchecks.js
View File

@ -208,7 +208,9 @@
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
}; };
for (var header in securityHeaders) { for (var header in securityHeaders) {

49
core/js/tests/specs/setupchecksSpec.js
View File

@ -389,7 +389,14 @@ describe('OC.SetupChecks tests', function() {
}, { }, {
msg: 'The "X-Frame-Options" HTTP header is not configured to equal to "SAMEORIGIN". This is a potential security or privacy risk and we recommend adjusting this setting.', msg: 'The "X-Frame-Options" HTTP header is not configured to equal to "SAMEORIGIN". This is a potential security or privacy risk and we recommend adjusting this setting.',
type: OC.SetupChecks.MESSAGE_TYPE_WARNING type: OC.SetupChecks.MESSAGE_TYPE_WARNING
}]); }, {
msg: 'The "X-Download-Options" HTTP header is not configured to equal to "noopen". This is a potential security or privacy risk and we recommend adjusting this setting.',
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
}, {
msg: 'The "X-Permitted-Cross-Domain-Policies" HTTP header is not configured to equal to "none". This is a potential security or privacy risk and we recommend adjusting this setting.',
type: OC.SetupChecks.MESSAGE_TYPE_WARNING
},
]);
done(); done();
}); });
}); });
@ -403,7 +410,9 @@ describe('OC.SetupChecks tests', function() {
{ {
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN', 'X-Frame-Options': 'SAMEORIGIN',
'Strict-Transport-Security': 'max-age=15768000;preload' 'Strict-Transport-Security': 'max-age=15768000;preload',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
} }
); );
@ -430,7 +439,9 @@ describe('OC.SetupChecks tests', function() {
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN', 'X-Frame-Options': 'SAMEORIGIN',
'Strict-Transport-Security': 'max-age=15768000' 'Strict-Transport-Security': 'max-age=15768000',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
} }
); );
@ -450,7 +461,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
} }
); );
@ -494,7 +507,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
} }
); );
@ -517,7 +532,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
} }
); );
@ -540,7 +557,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
} }
); );
@ -562,7 +581,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
}); });
async.done(function( data, s, x ){ async.done(function( data, s, x ){
@ -580,7 +601,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
}); });
async.done(function( data, s, x ){ async.done(function( data, s, x ){
@ -598,7 +621,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
}); });
async.done(function( data, s, x ){ async.done(function( data, s, x ){
@ -616,7 +641,9 @@ describe('OC.SetupChecks tests', function() {
'X-XSS-Protection': '1; mode=block', 'X-XSS-Protection': '1; mode=block',
'X-Content-Type-Options': 'nosniff', 'X-Content-Type-Options': 'nosniff',
'X-Robots-Tag': 'none', 'X-Robots-Tag': 'none',
'X-Frame-Options': 'SAMEORIGIN' 'X-Frame-Options': 'SAMEORIGIN',
'X-Download-Options': 'noopen',
'X-Permitted-Cross-Domain-Policies': 'none',
}); });
async.done(function( data, s, x ){ async.done(function( data, s, x ){

2
lib/private/response.php
View File

@ -260,6 +260,8 @@ class OC_Response {
header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains
header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag header('X-Robots-Tag: none'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
header('X-Download-Options: noopen'); // https://msdn.microsoft.com/en-us/library/jj542450(v=vs.85).aspx
header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
} }
} }