http potential vulnerability
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 37
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
QMUL have just contacted Jisc about two potential vulnerabilities in the perfSONAR toolkit web page.
(0) The toolkit Does Not Implement HSTS Best Practices Not implementing HTTP Strict Transport Security (HSTS)
I believe this casn be easily fixed by adding to the file apache-toolkit_web_gui-le-ssl.conf the line
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
I have done it for ps-slough-lat.ja.net.
Can some security wizzard check/amend?
(1) Site Does Not Use Best Practices Against Embedding of Malicious Content Not using X-Frame-Options means greater vulnerability to clickjacking attacks.
I am puzzling on that.
Raul
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting apache-toolkit_web_gui-le-ssl.conf and review how the HTTPS web GUI headers are configured. Verify the proposed HSTS setting and determine the appropriate X-Frame-Options protection for the reported clickjacking concern. Done means both security headers are configured and their presence can be verified in the HTTPS response.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100