Add Content-Security-Policy to example webserver configs #266

Closed
opened 2018-08-26 22:56:50 +00:00 by shibayashi · 14 comments
Member

Hi,

as a defense in depth step, I would like to add example CSPs to the server configs. Before I create a MR for that, I would like some feedback :)

Here is a CSP which was tested with pleroma-fe and mastofe:

content-security-policy:
default-src 'none';
base-uri 'self';
connect-src 'self' wss://domain.tld;
font-src 'self';
form-action 'self';
img-src 'self' data: https:;
media-src 'self' https:;
script-src 'self';
style-src 'self' 'unsafe-inline';
upgrade-insecure-requests;

I don’t know, if Vue.js supports a CSP without style-src 'unsafe-inline'.

Would be great, if some people could test the headers to make sure, everything still works. :)

Hi, as a defense in depth step, I would like to add example CSPs to the server configs. Before I create a MR for that, I would like some feedback :) Here is a CSP which was tested with pleroma-fe and mastofe: ``` content-security-policy: default-src 'none'; base-uri 'self'; connect-src 'self' wss://domain.tld; font-src 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; script-src 'self'; style-src 'self' 'unsafe-inline'; upgrade-insecure-requests; ``` I don’t know, if Vue.js supports a CSP without `style-src 'unsafe-inline'`. Would be great, if some people could test the headers to make sure, everything still works. :)
Member

This is the one I was using, which seems a lot simpler than yours:

add_header 'Content-Security-Policy' "object-src 'none'; script-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self';";

https://observatory.mozilla.org/analyze/post.catgirl.science

This is the one I was using, which seems a lot simpler than yours: ~~~ add_header 'Content-Security-Policy' "object-src 'none'; script-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self';"; ~~~ https://observatory.mozilla.org/analyze/post.catgirl.science
Author
Member

That’s because of the default-src 'none' directive which Mozilla recommends.

That’s because of the `default-src 'none'` directive which Mozilla recommends.
Owner

Here is mine, which works with both mastofe and pleroma-fe and removes quite a lot compared to shibayashi’s: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; media-src 'self' https:; connect-src wss://queer.hacktivis.me 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'; upgrade-insecure-requests;

https://observatory.mozilla.org/analyze/queer.hacktivis.me

Here is mine, which works with both mastofe and pleroma-fe and removes quite a lot compared to shibayashi’s: ``default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; media-src 'self' https:; connect-src wss://queer.hacktivis.me 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'; upgrade-insecure-requests;`` https://observatory.mozilla.org/analyze/queer.hacktivis.me
Author
Member

I updated my example above according to your tested config. The differences I’ve seen:

  • connect-src containing blob:. Removed that, because it’s apparently not necessary.
  • font-src. Removed that, because it’s only necessary, if one wants to serve webfonts.
I updated my example above according to your tested config. The differences I’ve seen: * `connect-src` containing `blob:`. Removed that, because it’s apparently not necessary. * `font-src`. Removed that, because it’s only necessary, if one wants to serve webfonts.
Owner

Also, is there any reason to keep object-src ? It’s used only for stuff that isn’t audio/video/img and it’s typically used for plugins.

Also, is there any reason to keep `object-src` ? It’s used only for stuff that isn’t `audio`/`video`/`img` and it’s typically used for plugins.
Author
Member

You’re right. I removed it.

You’re right. I removed it.
Owner

Okay, let’s get this one done and then I’ll change the example nginx configuration I guess.
The current diff between our CSP with removing the useless directive 'none' statements and sorting it:

--- csp-lanodan 2018-08-28 19:40:54.935879526 +0200
+++ csp-shibayashi      2018-08-28 19:37:21.639870473 +0200
@@ -1,8 +1,8 @@
+base-uri 'self';
 connect-src 'self' wss://host;
 default-src 'none';
-form-action 'self';
 img-src 'self' data: https:;
-media-src 'self' https:;
+media-src 'self' data: https:;
 script-src 'self';
 style-src 'self' 'unsafe-inline';
 upgrade-insecure-requests;

I’m pretty sure base-uri 'self' and form-action 'self' is safe to be added, media-src data: is definitely useless.

So I think we can go with this:

default-src 'none';
base-uri 'self';
form-action 'self';
img-src 'self' data: https:;
media-src 'self' https:;
style-src 'self' 'unsafe-inline';
font-src 'self';
script-src 'self';
connect-src 'self' wss://host;
upgrade-insecure-requests;
Okay, let’s get this one done and then I’ll change the example nginx configuration I guess. The current diff between our CSP with removing the useless ``directive 'none'`` statements and sorting it: ```diff --- csp-lanodan 2018-08-28 19:40:54.935879526 +0200 +++ csp-shibayashi 2018-08-28 19:37:21.639870473 +0200 @@ -1,8 +1,8 @@ +base-uri 'self'; connect-src 'self' wss://host; default-src 'none'; -form-action 'self'; img-src 'self' data: https:; -media-src 'self' https:; +media-src 'self' data: https:; script-src 'self'; style-src 'self' 'unsafe-inline'; upgrade-insecure-requests; ``` I’m pretty sure ``base-uri 'self'`` and ``form-action 'self'`` is safe to be added, ``media-src data:`` is definitely useless. So I think we can go with this: ``` default-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://host; upgrade-insecure-requests; ```
Author
Member

Looks like we need to add font-src 'self' after all.

font-src-error

Looks like we need to add `font-src 'self'` after all. ![font-src-error](/attachments/10f0e12f-10f3-41a7-a30b-5cc3e18c3858)
Owner

Ah yes… I didn’t hit this issue because I have the font installed to avoid fetching it everywhere.

Ah yes… I didn’t hit this issue because I have the font installed to avoid fetching it everywhere.
Owner

So with the font issue fixed, do you think it is okay now?

So with the font issue fixed, do you think it is okay now?
Author
Member

Yeah, I updated the OP one last time based on your suggestion.

Yeah, I updated the OP one last time based on your suggestion.
Author
Member

I have no problem with updating all server examples and creating the merge request, if that’s ok for you.

I have no problem with updating all server examples and creating the merge request, if that’s ok for you.
Owner

It’s okay, I’ll just push it directly a MR doesn’t add anything I guess.

It’s okay, I’ll just push it directly a MR doesn’t add anything I guess.
Author
Member

Ah, you have master permissions, I see :)

Let’s 🚢 it

Ah, you have master permissions, I see :) Let’s :ship: it
Sign in to join this conversation.
No milestone
No project
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma#266
No description provided.