mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-06-25 16:19:19 +02:00

Files

Pontoporeia 04094d802d fix: harden security based on pentest scan findings

- Add Content-Security-Policy to main nginx server block (was only on /admin/)
- Add Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy headers
- Add includeSubDomains to HSTS header
- Set HttpOnly, Secure, SameSite=Lax session cookie params on public pages
  (AdminAuth already hardens the /admin session with SameSite=Strict)
- Update xamxam.conf.reference and SECURITY_HEADERS.md to match

2026-05-19 00:08:06 +02:00

2.3 KiB

Raw Blame History

Security Headers — nginx/xamxam.conf

Headers in use (main server block — all pages)

Header	Value	Purpose
`Strict-Transport-Security`	`max-age=63072000; includeSubDomains; preload;`	HSTS — forces HTTPS
`Content-Security-Policy`	`default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';`	Restrict resource origins; block embedding
`X-Frame-Options`	`SAMEORIGIN`	Prevent clickjacking
`X-Content-Type-Options`	`nosniff`	Prevent MIME-type sniffing
`Referrer-Policy`	`strict-origin-when-cross-origin`	Limit referrer leakage
`Permissions-Policy`	`geolocation=(), microphone=(), camera=()`	Disable unused browser APIs
`Cross-Origin-Opener-Policy`	`same-origin`	Isolates browsing context
`Cross-Origin-Resource-Policy`	`same-origin`	Controls cross-origin resource sharing

Headers in use (`/admin/` location block — inherited from main + overrides)

Header	Value	Purpose
`Content-Security-Policy`	`default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';`	Restrict resource origins; allows inline scripts for OverType editor
`X-Robots-Tag`	`noindex, nofollow`	Prevent search-engine indexing of admin

These were previously declared in public/admin/.htaccess as Apache mod_headers directives, which nginx silently ignores. They are now properly configured in nginx/xamxam.conf. enforced directly; see HTACCESS_TO_NGINX.md for the full migration log.

Intentionally omitted headers

`X-XSS-Protection`

This header was removed (was "1; mode=block").

Why: X-XSS-Protection is deprecated and removed from all modern browsers (Chrome 78+, Firefox never implemented it, Edge dropped it). Worse, the mode=block behaviour can be actively exploited to expose response bodies that would otherwise be blocked. Sending it provides no protection and may introduce risk.

Correct mitigation: a proper Content-Security-Policy header (now done for /admin/; public-page CSP is todo item #11).

2.3 KiB Raw Blame History