Content Security Policy HTTP security header

[Jacques Le Roux <ja...@les7arts.com>]

Hi,

At https://cwiki.apache.org/confluence/display/OFBIZ/How+to+Secure+HTTP+Headers I have summarize my work on HTTP Security Headers

I have done the easy part, ie all headers but Content-Security-Policy. They are grouped in RequestHandler.renderView() just before rendering the view

For Content-Security-Policy I'd like to use the safer one OOTB ie: resp.setHeader("Content-Security-Policy", "default-src 'self'");

This means that all resources links should be local. The resources types are script, object (plugins), style, img, media, frame, font, connect and form.

No need to say that it's very ambitious and not for today.

The 1st task to handle is to remove as much as possible JavaScript snippets and have as much as possible JavaScript files.

There are already few Jiras about that and we are slowly heading in the right direction.

It's not sure we can reach this very ambitious goal and the good news is that it's not a problem if we don't.

When we will hit cases where local it's not possible then we can define so called nonce to be sure the resources are loaded from the right place.

In no case we should OOTB use the lazy unsafe-inline and eval-inline.

To not block anything for the moment I have committed a simple most restrictive Content-Security-Policy-Report-Only header at r1812720

Then we can look at the issues using browsers tools (there are so much)

The next step is to report the errors (when there will not be too much) in the log using a report-uri

And ultimately to use OOTB the most simple and constraining policy, with exceptions of course (as ever).

Note: if we encounter performance issue we can comment out the current Content-Security-Policy-Report-Only

Jacques