[I] Deployed nginx config sets no HTTP security headers [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal opened a new issue, #216:
URL: https://github.com/apache/fineract-backoffice-ui/issues/216

   Part of the GA security hardening work.
   
   ## Summary
   
   `deploy/nginx.conf` — the config the shipped container serves the application with — sets no
   security headers at all. A grep for `Content-Security-Policy`, `Strict-Transport-Security`,
   `X-Frame-Options`, `X-Content-Type-Options` and `Referrer-Policy` returns zero matches.
   
   ## Business value
   
   **These are the backstop for everything the application cannot control.**
   
   The codebase is in good shape on the application side: no `bypassSecurityTrust`, no `innerHTML`
   sinks, no raw HTML rendering, and the GA check gates that so a single careless commit cannot
   remove it. But that only covers what this code does. Headers cover what a browser will permit
   regardless:
   
   - **Without a CSP**, any injected string that does reach the DOM can load and execute remote
     script, and can exfiltrate to any host. With one, the same injection has nowhere to send data.
   - **Without `X-Frame-Options` / `frame-ancestors`**, the application can be framed and
     clickjacked — a real risk for a back office where a single click approves or disburses money.
   - **Without `nosniff`**, a response the server mislabels can be reinterpreted as script.
   - **Without `Referrer-Policy`**, account and client identifiers in the URL leak to any external
     host the user navigates to.
   - **Without HSTS**, a first request over plain HTTP is interceptable.
   
   A back office that moves money is exactly the deployment where these are expected, and their
   absence is the kind of thing a security review finds immediately.
   
   ## Scope
   
   Set all five on the server block, with `always` so they are present on error responses too — which
   is where a reflected payload would land.
   
   The CSP should not admit `unsafe-eval`: the AOT build does not need it, and it would give an
   injected string a route to execution. `unsafe-inline` is needed for styles only, because Angular
   emits component styles inline and there is no nonce plumbed through a static file server; scripts
   should not get it.
   
   `connect-src` should allow the same origin only. A deployment whose Fineract is on another host
   adds that origin here as well as to the application's allow-list — the two are deliberately
   separate, so a browser-side setting alone cannot open a new destination.
   
   ## Acceptance criteria
   
   - [ ] All five headers set, with `always`.
   - [ ] The config passes `nginx -t`.
   - [ ] The headers are observable on a real response from the container image.
   - [ ] `npm run ga:check` reports this gate as passing.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Deployed nginx config sets no HTTP security headers [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal closed issue #216: Deployed nginx config sets no HTTP security headers
URL: https://github.com/apache/fineract-backoffice-ui/issues/216


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Deployed nginx config sets no HTTP security headers [fineract-backoffice-ui]

["Aman-Mittal (via GitHub)" <gi...@apache.org>]

Aman-Mittal commented on issue #216:
URL: https://github.com/apache/fineract-backoffice-ui/issues/216#issuecomment-5158697686

   Done and merged in #217.
   
   `deploy/nginx.conf` now sets all five headers on the server block, each with `always` so they
   survive error responses — which is where a reflected payload would land.
   
   The CSP admits no `unsafe-eval` (the AOT build does not need it, and it would give an injected
   string a route to execution); `unsafe-inline` is scoped to styles only, because Angular emits
   component styles inline and there is no nonce plumbed through a static file server. `connect-src`
   allows the same origin only, so a deployment whose Fineract is on another host adds that origin
   here *as well as* to the application's allow-list — the two are deliberately separate, so a
   browser-side setting alone cannot open a new destination.
   
   Verified two ways rather than by grepping the file: `nginx -t` passes against the real
   `nginx:alpine` image, and all five headers were observed on an actual response served from it.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org