Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • Lstu Lstu
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 30
    • Issues 30
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 2
    • Merge requests 2
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Fiat TuxFiat Tux
  • Hat softwaresHat softwares
  • LstuLstu
  • Issues
  • #37
Closed
Open
Issue created Jan 16, 2018 by Pierre Rudloff@RudloffContributor

X-Content-Type-Options, X-XSS-Protection, X-Frame-Options headers

It is a good practice to return a Content-Security-Policy header as it prevents different types of XSS attacks.

This is what we currently use on our lstu server:

Content-Security-Policy: default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; script-src 'unsafe-inline'

Here is what it means:

  • By default only allow resources from the same domain.
  • Don't allow objects and embeds.
  • Only allow styles from the same domain or from inline styles.
  • Only allow inline scripts.

I thought you might want to implement this directly into lstu.

It's also a good idea to define the following headers:

X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Edited Apr 27, 2018 by Luc Didry
Assignee
Assign to
Time tracking