Simple ways to improve the security of a web app | Hacker News Reader

Simple ways to improve the security of a web app

blog.fiesta.cc

126 pointsmdirolf22 comments

Your Strict-Transport-Security definition is missing the "includeSubDomains" flag. STS is a lot more effective if you use that flag.

You should discuss how X-Frame-Options prevents sites legitimately loading your pages inside frames too. I believe Reddit does this amongst others in order to displays a small control panel at the top of the page. X-Frame-Options is appropriate for many sites, but perhaps not for blogs.

You should talk about how CSP prevents most bookmarklets from working. For example readability and instapaper. I really like CSP, but people should be made aware of this.

Yeah, I decided not to get into all of the options of each header. Partially because I was writing from a plane without wifi and partially because the response I was hoping for was "these things exist - I'll go read the docs on them".

That said, your points about X-Frame-Options and CSP are definitely important for usability. Maybe I'll update the post w/ some of those details.

I wasn't expecting much from yet another "How to secure your website..." article, but those headers are completely new to me.

I came in swinging to tear apart yet another oblivious security article, but you actually taught me something.

Looking up X-Frame-Options and X-Content-Security-Policy now--thanks!

Glad you enjoyed it.

Learned a lot for my next startup. Thanks a lot for this post. I really appreciate.

This is one of the best article I've seen in a long time! Great job Mike and best of luck with your new startup!

Thanks!

It's articles like this that make me doubt that I've "probably read enough"[1].

[1] http://news.ycombinator.com/item?id=3326210

Chrome 15+ supports CSP. In 15 it uses an old syntax I believe but if you use 16+ then you should be able to use the same headers as in Firefox.

I didn't realize FF had CSP working as well. Thanks!

Good to know - thanks. More support is better, but the thing I really like about CSP is how it is still useful as a canary even with only partial browser support.

I may be going over old ground, but don't the CSP violations reports ( see https://developer.mozilla.org/en/Security/CSP/Using_CSP_viol... ) open up another attack vector?

I know people who actually implement this are going to have their heads screwed on around the right way, but having a page where you know you can generate server processing, and that is potentially not going to have much security around it screams out to me to be a good place to start an attack from.

Especially as the spec is a bit vague about exactly what happens when (no head specified for example, doesn't say about including cookies or any other information). Also, fiesta.cc's CSP Report URI returns a response that says to keep the connection open.

And, if you manage to get a script injected to a popular page, the site itself acts as a distribution system to enable distribution to multiple users.

Something about this says it's not been thoroughly thought through to me.

On that page you'll notice it mentions "request-headers". That was in FF4 and FF5, but was removed in FF6 because of something I reported.

The headers sent in the report included "Proxy-Authorization", so it was possible to steal web proxy credentials by forcing a policy violation on your site. Chromes implementation didn't include the headers from the start. For more info:

https://grepular.com/Mozilla_Security_Bug_Reveals_Web_Proxy_...

And the original report (which was recently "unclassified"):

https://bugzilla.mozilla.org/show_bug.cgi?id=664983

I had never heard of these HTTP headers before. Thank you for the pointers.

No problem - I definitely recommend reading the linked Mozilla docs on them.

Now only if we could combine this with improving the reliability of a web app.

From the comments it sounds like a great article, but I've been trying to read this for about 8 hours now with no luck.

Sorry about that - we use Tumblr to host the blog and have had some issues before. I just converted to a pastebin for you, unfortunately didn't think to include any of the comments but here you go: http://pastebin.com/yHw7L0Fy

Thanks!

http://www.theregister.co.uk/2011/06/21/startssl_security_br...

Yeah, fuck that. Like hell am I going to use a free CA as suggested. They have no incentive to keep things secure or in working order at all.

Great article otherwise though!

That doesn't really follow.

"The hackers behind the attack on StartCom failed to obtain any certificates that would allow them to spoof websites in a similar fashion, and they were also unsuccessful in generating an intermediate certificate that would allow them to act as their own certificate authority, Nigg said in an email."

As opposed to the Comodo breach where the attackers successfully managed to get fake certificates for several high-profile sites.

They're not a free CA. They're a business that sells certificates, and just so happens to also give out certain types of certificates for free.

They have just as much incentive to secure their systems as any other CA. Their reputation is just as important to them.

It doesn't matter which CA you use. If your CA, or any other trusted CA is compromised, you're affected exactly the same.

Ha fair enough, and thanks! One problem with the CA system is that (as far as I understand) it really doesn't matter whether you choose a particularly secure CA or not - you're as vulnerable as the most vulnerable CA. That's why something like public-key pinning is important.

Reply on news.ycombinator.com