Project

General

Profile

Actions
Copy link

Improvements #13187

closed

Allow custom headers to be configured in the config file

Added by Matthias Van Ceulebroeck 3 months ago. Updated 6 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Romain Mardulyn
Target version:
4.11.2
Start date:
11/06/2024
Due date:
% Done:

100%

Estimated time:

Description

Similar to head-matter and meta-headers there should be a headers section in the configuration.

These will define headers that will always be set by the application for each of its responses. By default they will:

  • be as permissive as possible, if they affect functionality.
  • be according to ASVS guidelines (see section 14.4: HTTP Security Headers), if they can be set as such without functionality being affected

Related issues 3 (0 open — 3 closed)

Related to Bug #13042: Disallow content type sniffingRejected09/13/2024

Actions
Related to Bug #8156: X-Frame-Option=SAMEORIGIN doesn't let my application be visualized inside iframeRejected02/26/2021

Actions
Related to Improvements #6584: Make X-Frame-Options a configuration optionClosedRomain Mardulyn09/04/2018

Actions
Actions
Copy link
 #1

Updated by Matthias Van Ceulebroeck 3 months ago

  • Related to Bug #13042: Disallow content type sniffing added
Actions
Copy link
 #2

Updated by Matthias Van Ceulebroeck 3 months ago

  • Related to Bug #8156: X-Frame-Option=SAMEORIGIN doesn't let my application be visualized inside iframe added
Actions
Copy link
 #3

Updated by Matthias Van Ceulebroeck 3 months ago

Actions
Copy link
 #4

Updated by Matthias Van Ceulebroeck 3 months ago

ASVS headers of importance are:

  • Content-Type
  • Content-Disposition
  • Content Security Policy (CSP)
  • X-Content-Type-Options (nosniff)
  • Strict-Transport-Security (often set by proxy)
  • Referrer-Policy

Only the first two are satisfied.
The last four should be added.

Actions
Copy link
 #5

Updated by Romain Mardulyn 3 months ago

  • Status changed from New to InProgress
  • Assignee set to Romain Mardulyn
Actions
Copy link
 #6

Updated by Romain Mardulyn 2 months ago

  • Status changed from InProgress to Review
  • Assignee deleted (Romain Mardulyn)
Actions
Copy link
 #7

Updated by Matthias Van Ceulebroeck 15 days ago

  • Assignee set to Matthias Van Ceulebroeck
Actions
Copy link
 #8

Updated by Matthias Van Ceulebroeck 7 days ago

  • Status changed from Review to Implemented @Emweb
  • Assignee changed from Matthias Van Ceulebroeck to Romain Mardulyn
  • % Done changed from 0 to 100
Actions
Copy link
 #9

Updated by Matthias Van Ceulebroeck 6 days ago

  • Status changed from Implemented @Emweb to Implemented @Test
Actions
Copy link
 #10

Updated by Matthias Van Ceulebroeck 6 days ago

  • Status changed from Implemented @Test to Closed
Actions
Copy link

Also available in: Atom PDF