[feature] Set some security related headers #3065
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This ensures we can't be loaded/embedded in an iframe. It also sets the older X-Frame-Options for fallback.
This sets the policy such that browsers will never send the Referer header along with a request, unless it's a request to the same protocol, host/domain and port. Basically, only send it when navigating through our own UI, but not anything external. The default is strict-origin-when-cross-origin when unset, which sends the Referer header for requests unless it's going from HTTPS to HTTP (i.e a security downgrade, hence the 'strict').
daenney
commented
Jul 3, 2024
| @@ -27,6 +27,15 @@ func ExtraHeaders() gin.HandlerFunc { | |||
| // Inform all callers which server implementation this is. | |||
| c.Header("Server", "gotosocial") | |||
|
|
|||
| // Equivalent to CSP frame-ancestors for older browsers | |||
| c.Header("X-Frame-Options", "DENY") | |||
There was a problem hiding this comment.
Caps here don't matter but so many examples go full caps on it. So. DENYed.
|
Looks reasonable :) wanna merge it as is or would you rather wait and add more stuff this PR? |
|
Lets merge this batch. I can do additional ones for other headers because some of them are quite involved. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This sets a few basic security related headers, aside from the CSP which we already have.
I'm slowly going through https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html and figuring out what applies.
Each commit is a separate header + the why of it.
Checklist
Please put an x inside each checkbox to indicate that you've read and followed it:
[ ]->[x]If this is a documentation change, only the first checkbox must be filled (you can delete the others if you want).
go fmt ./...andgolangci-lint run.