Adding security headers in play framework configuration - security

I am trying to add additional security headers in play framework configuration but my changes are not getting reflected. I read through the play documentation and it says the play.filters.headers only accept 5 pre-defined security headers.
# Security headers filter configuration
headers {
# The X-Frame-Options header. If null, the header is not set.
frameOptions = "DENY"
# The X-XSS-Protection header. If null, the header is not set.
xssProtection = "1; mode=block"
# The X-Content-Type-Options header. If null, the header is not set.
contentTypeOptions = "nosniff"
# The X-Permitted-Cross-Domain-Policies header. If null, the header is not set.
permittedCrossDomainPolicies = "master-only"
# The Content-Security-Policy header. If null, the header is not set.
contentSecurityPolicy = "default-src 'self'"
}
Any idea how to do if i need to add additional headers in the configuration apart from the above 5 mentioned.
Play version is 2.2.3

Play's security headers filter isn't available for Play 2.2.x.
It was first introduced with Play 2.3
You probably were looking at the latest (2.4.x at the time of writing this) docs.

Related

Why is my CSP Header still reporting violations on sources I have wildcarded?

I'm using a wildcard like so: *.example.com under the impression that totallysafe.example.com, foobar.example.com, some-other.example.com and whatever other subdomain would be allowed.
So for example, I'm using NGINX to apply the CSP header (minified version of my source code):
set $SCRIPT_DIRECTIVE "script *.google.com";
set $REPORT-URI "report-uri wonkyprefix.ingest.sentry.io/blahblahblah";
add_header Content-Security-Policy "${SCRIPT_DIRECTIVE}, ${REPORT-URI}";
When I'm monitoring CSP violations coming from my app in Sentry, I see script-src violations for apis.google.com.
Any ideas or solutions?

antiClickJack snippet's style tag part being inline requires unsafe-inline. How can we avoid the use of unsafe-inline?

I am working on Drupal 9.3.8 site and using CSP module to setup the CSP header.
There are few core dependencies or contrib modules which require unsafe-inline in CSP header but scanner recommends not the have unsafe-inline, so looking for the fix to remove the use of unsafe-inline.
Dependencies that require unsafe-inline:
Drupal core ckeditor, modernizer and AJAX calls - which can be handled by CSP module used above which adds unsafe-inline only when ckeditor renders, but not when only modernizer is required.
Google Analytics module - which adds the script inline instead of putting it in a file and include it on each page. We have the patch compatible with D7 but not for D8/9.
AntiClickJack snippet which is as below:
<style id="antiClickjack">body{display: none !important;}</style>
Solutions:
Installed and setup CSP module as mentioned above to handle Drupal core libs/dependencies requirement.
To handle only rendering of modernizer.js and unsafe-inline, will need customization to the CSP module.
For antiClickJack and google analytics script and style tags, cannot add hash or nonce as unsafe-inline will be ignored which will break the handling of Drupal core requirements
CSP header that I have is as below:
Content-Security-Policy: default-src 'self'; connect-src 'self' www.google-analytics.com; frame-src 'none'; img-src 'self' data: https://www.google-analytics.com; object-src 'none'; script-src 'self' www.googletagmanager.com www.google-analytics.com ajax.googleapis.com 'unsafe-inline'; script-src-elem 'self' www.googletagmanager.com www.google-analytics.com ajax.googleapis.com; style-src 'self' 'unsafe-inline'; frame-ancestors 'none';
Questions:
How to handle antiClickJack snippet to avoid the use of unsafe-inline?
Do we have a customized approach to add the google analytics script to a file instead of adding it inline?
Add the following hash to your style-src: 'sha256-NHgJfLahpnqTyd+gTNfZfM2wjTUfB3Wk1CvqZfZpeHY=' Most browsers will suggest a hash for you, or you can use https://report-uri.com/home/hash. Note that the hash works as long as the content is unchanged, so only use it for static code.
Google Analytics and Google Tag Manager are not easy to implement without 'unsafe-inline'. You might be able to move to a file, but I don't know if that has an impact on the order of events. You will also need to look into CSP nonces for the code they insert. You will need to configure them to use your nonce and make sure that a new nonce is created for every page load. My experience is that setting a custom value for the nonce and change it for every page load is not trivial or possible within some frameworks, but worth giving a try.

htaccess CSP - images blocked on firefox (but working on chrome)

I have a problem loading YouTube thumbnails on Firefox, the images are blocked while on Chrome, it works fine. On Firefox I get the error NS ERROR INTERCEPTION FAILED in the network tab from the developer tools and if I remove my CSP in my htaccess file, those images are loaded correctly.
My CSP looks like this:
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options: "nosniff”
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.laurentwillen.be https://*.googleapis.com https://*.googletagmanager.com https://www.google-analytics.com/ https://www.google.com https://cse.google.com https://*.gstatic.com https://*.youtube.com/ https://*.mobilemultimedia.be"
Header set Referrer-Policy "same-origin"
and the call to the image looks like this:
<img src="https://img.youtube.com/vi/xSbxgNuBfR0/0.jpg" alt="youtube_preview" width="100%">
Do you know how I could go around this and make Firefox load those images just like Chrome?
Thanks

How to set X-Frame-Options?

can you tell me please where do I set these options on the server (godaddy linux apache)? shoudl I just place them in htaccess file?
Header set X-Frame-Options: “ALLOW_FROM https://specificdomain.com”
Header set Content-Security-Policy: “frame-ancestors https://specificdomain.com”
Yes you can put it in .htacces file
like this
Header always set X-FRAME-OPTIONS "DENY"
for more information read on mdn

Trying to render iframe: ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"

I would like to render an iframe with the source being Github like so:
<iframe src="https://gist.github.com/user45445/9bf8d568e3350146ba302d7d67ad576f"> </iframe>
This is the error I get in the console:
Refused to display 'https://gist.github.com/fresh5447/9bf8d568e3350146ba302d7d67ad576f' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'".
I was researching how to specify my Content Security Policy in my Node server, to specify that it should accept any iframes from github
So I installed csp-helmet and added this to my server code:
var csp = require('helmet-csp')
app.use(csp({
// Specify directives as normal.
directives: {
frameAncestors: ['*.github.com'], //I thought these two did the same, so I tried them both.
childSrc: ['*.github.com']
},
// Set to true if you only want browsers to report errors, not block them.
// You may also set this to a function(req, res) in order to decide dynamically
// whether to use reportOnly mode, e.g., to allow for a dynamic kill switch.
reportOnly: false,
// Set to true if you want to blindly set all headers: Content-Security-Policy,
// X-WebKit-CSP, and X-Content-Security-Policy.
setAllHeaders: false,
// Set to true if you want to disable CSP on Android where it can be buggy.
disableAndroid: false,
// Set to false if you want to completely disable any user-agent sniffing.
// This may make the headers less compatible but it will be much faster.
// This defaults to `true`.
browserSniff: true
}))
But still the same error..
I have been trying to look at the official docs and the HTML5 rocks guide
Not sure if I am super close or taking the completely wrong approach.
Update
I have also tried to set the CSP via meta tag.
<meta http-equiv="Content-Security-Policy" content="child-src https://gist.github.com; frame-ancestors https://gist.github.com;">
than I received this error:
Content Security Policies delivered via a <meta> element may not contain the frame-ancestors directive.
The frame-ancestors value acts on the source of the iframe not the document framing it. Setting CSP on your page will have no effect on the framing. Think of frame-ancestors like X-Frame-Options on steroids: it restricts what is allowed to frame the content. Gist intentionally does not allow directly framing gists but instead provides a way to embed a Gist.
frame-ancestors 'none' == X-Frame-Options: DENY
As oreoshake points out, the problem here is not your CSP, but the CSP on GitHub. It is GitHub that is preventing you from framing them so there is nothing you can do with your CSP to resolve this.
I got the exact same error when using the wrong URL in my iframe's src field. I had copied the URL directly from the address bar instead of clicking on embed and copying it from there.

Resources