microsoft / microsoft/azurechat
missing security headers
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.4k
- Forks
- 1.3k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 1
Description
how to resolve the critical vulnerabilities listed on this app.
strict-transport-security
X-Frame-Option
x-content-type-options
Content-security-policy
Referrer-Policy
Permissions-Policy
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by locating the app's HTTP response configuration and checking which of the six listed security headers are currently absent or misconfigured. Done means the application emits the expected Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy, and Permissions-Policy headers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, typescript
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100