HTTP Security headers you should be using

Re:HTTP Security headers you should be using by michaelmcmillan on Thursday January 23, 2014 @11:16AM (#7109047)

I must admit it is a little ironic that your site doesn't use the security headers you advocate.

[ Parent | on HN ]

Re:HTTP Security headers you should be using by relaxnow on Thursday January 23, 2014 @02:34PM (#7110581)

The irony is not lost on me, we have a saying in the Netherlands "the carpenters doors are the creakiest". Also we don't use them all the time yet even for customers, this blog post (and an accompanying internal training next week) is meant to remedy that.

[ Parent | on HN ]

Re:HTTP Security headers you should be using by mantas on Friday January 24, 2014 @05:49AM (#7114287)

Indeed they're. Looks like comments on your blog don't work. And there's no RSS feed :(

[ Parent | on HN ]

Re:HTTP Security headers you should be using by tptacek on Thursday January 23, 2014 @11:18AM (#7109069)

Tell me, which of the four headers he talked about --- CSP, XFO, XCTO, and HSTS --- are going to cause serious problems for a blog?

[ Parent | on HN ]

Re:HTTP Security headers you should be using by pornel on Thursday January 23, 2014 @11:46AM (#7109251)

CSP would be useful defense in depth if the blog has comments and an admin interface on the same domain or subdomain within TLD/public suffix — XSS in a comment could lead to session fixation/hijacking.

XFO also might be useful if the blog has predictable layout of the admin interface — logged-in blog admin could be tricked via clickjacking to perform potentially undesirable actions.

[ Parent | on HN ]

Re:HTTP Security headers you should be using by michaelmcmillan on Thursday January 23, 2014 @12:39PM (#7109665)

The directory entries at http://ibuildings.nl/robots.txt suggest that they're hosting much more than a blog on that domain.

Edit: As others pointed it out, it's a Drupal installation. Trusting Drupal to be 100% safe in regards to malicious attacks is not a good idea. I know this is nitpicking, it is however still ironic.

http://www.cvedetails.com/vulnerability-list/vendor_id-1367/...

[ Parent | on HN ]

Re:HTTP Security headers you should be using by yeukhon on Thursday January 23, 2014 @12:42PM (#7109688)

It's a drupal-powered site. It's no different from WP though IMO.

[ Parent | on HN ]

Re:HTTP Security headers you should be using by yeukhon on Thursday January 23, 2014 @12:16PM (#7109474)

At least he should enable XFO if he doesn't want to be framed.

His HTTPS endpoint is not trusted by the browser, either self-signed or missing some intermediary cert... If he wants to enable the contact form for business inquiry or personal inquiry, might be worthwhile to get some $10 cert? If he already ahve gotten that far to get a 443 port enabled.

XCTO is pretty cheap to enable and doesn't hurt. The only problem is IRRC IE has a different MIME list then Firefox and Chrome.

It's pretty cheap to enable some of these security headers, just as it is relatively easy to disable some of the server-type headers (x-powered-by e.g, which apparently he doesn't have it exposed I think)

[ Parent | on HN ]