Missing Security-Related HTTP Headers

Description
During the engagement, LMG identified that web service responses did not contain one or more of the following security-related HTTP header flags:

• Content-Security-Policy
• X-Permitted-Cross-Domain-Policies
• Cross-Origin-Resource-Policy
• X-XSS-Protection

Web administrators can use Content-Security-Policy (CSP) as an added layer of security that helps the web server detect and mitigate certain types of attacks, including XSS and data injection attacks. There are currently three header options that define allowed content types and the ability to define sources of trusted JavaScript.

To ensure the website is calling the cross-domain file that the site’s root has defined, administrators should implement the X-Permitted-Cross-Domain-Policies header. This is similar to a crossdomain.xml policy file and restricts/allows locations where Flash content can be accessed.

The Cross-Origin Resource Policy (CORP) header can be set to allow websites and applications to block certain requests from other origins such as <script> and < img>. This can mitigate side-channel attacks, like Spectre and XSS attacks.

Additional context
LMG recommends that system administrators add the following HTTP headers as required. Typical options include:

• Content-Security-Policy
• X-Permitted-Cross-Domain-Policies: master-only
• Cross-Origin-Resource-Policy
• X-XSS-Protection

LMG Document
https://drive.google.com/file/d/18vNuBbHOTZCrTZYvgz7oAbVwzfAJwsdd/view?usp=share_link