Project

General

Profile

Actions
Copy link

Improvements #13187

closed
MV RM

Allow custom headers to be configured in the config file

Improvements #13187: Allow custom headers to be configured in the config file

Added by Matthias Van Ceulebroeck almost 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Romain Mardulyn
Target version:
4.11.2
Start date:
11/06/2024
Due date:
% Done:

100%

Estimated time:

Description

Similar to head-matter and meta-headers there should be a headers section in the configuration.

These will define headers that will always be set by the application for each of its responses. By default they will:

  • be as permissive as possible, if they affect functionality.
  • be according to ASVS guidelines (see section 14.4: HTTP Security Headers), if they can be set as such without functionality being affected

Related issues 3 (0 open — 3 closed)

Related to Bug #13042: Disallow content type sniffingRejected09/13/2024

Actions
Related to Bug #8156: X-Frame-Option=SAMEORIGIN doesn't let my application be visualized inside iframeRejected02/26/2021

Actions
Related to Improvements #6584: Make X-Frame-Options a configuration optionClosedRomain Mardulyn09/04/2018

Actions

MV Updated by Matthias Van Ceulebroeck almost 2 years ago Actions
Copy link
 #1

  • Related to Bug #13042: Disallow content type sniffing added

MV Updated by Matthias Van Ceulebroeck almost 2 years ago Actions
Copy link
 #2

  • Related to Bug #8156: X-Frame-Option=SAMEORIGIN doesn't let my application be visualized inside iframe added

MV Updated by Matthias Van Ceulebroeck almost 2 years ago Actions
Copy link
 #3

MV Updated by Matthias Van Ceulebroeck almost 2 years ago Actions
Copy link
 #4

ASVS headers of importance are:

  • Content-Type
  • Content-Disposition
  • Content Security Policy (CSP)
  • X-Content-Type-Options (nosniff)
  • Strict-Transport-Security (often set by proxy)
  • Referrer-Policy

Only the first two are satisfied.
The last four should be added.

RM Updated by Romain Mardulyn almost 2 years ago Actions
Copy link
 #5

  • Status changed from New to InProgress
  • Assignee set to Romain Mardulyn

RM Updated by Romain Mardulyn almost 2 years ago Actions
Copy link
 #6

  • Status changed from InProgress to Review
  • Assignee deleted (Romain Mardulyn)

MV Updated by Matthias Van Ceulebroeck over 1 year ago Actions
Copy link
 #7

  • Assignee set to Matthias Van Ceulebroeck

MV Updated by Matthias Van Ceulebroeck over 1 year ago Actions
Copy link
 #8

  • Status changed from Review to Implemented @Emweb
  • Assignee changed from Matthias Van Ceulebroeck to Romain Mardulyn
  • % Done changed from 0 to 100

MV Updated by Matthias Van Ceulebroeck over 1 year ago Actions
Copy link
 #9

  • Status changed from Implemented @Emweb to Implemented @Test

MV Updated by Matthias Van Ceulebroeck over 1 year ago Actions
Copy link
 #10

  • Status changed from Implemented @Test to Closed
Actions
Copy link

Also available in: PDF Atom