... | ... | @@ -65,3 +65,49 @@ satisfy all |
|
|
ErrorDocument 403 "Forbidden"
|
|
|
</FilesMatch>
|
|
|
```
|
|
|
|
|
|
## Secure server
|
|
|
|
|
|
## HTTPS
|
|
|
|
|
|
It is really advided to use HTTPS and make HTTP redirect to it. Use Let's Encrypt to obtain free certificates.
|
|
|
|
|
|
## Content Security Policy
|
|
|
|
|
|
If you have access to the configuration of your Framadate web server, it is [a good practice](https://wiki.mozilla.org/Security/Guidelines/Web_Security#Content_Security_Policy) to return a `Content-Security-Policy` header as it prevents different types of XSS attacks.
|
|
|
|
|
|
### Apache
|
|
|
|
|
|
```apache
|
|
|
<IfModule mod_headers.c>
|
|
|
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self'"
|
|
|
</IfModule>
|
|
|
```
|
|
|
|
|
|
### Nginx
|
|
|
```nginx
|
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self'";
|
|
|
```
|
|
|
|
|
|
## Referrer-Policy
|
|
|
|
|
|
If someone clicks on an external link inside a survey, the website that link points to will get the survey address in the `Referer` HTTP header. With the `Referrer-Policy`, we can tweak which information is sent.
|
|
|
|
|
|
```apache
|
|
|
<IfModule mod_headers.c>
|
|
|
Header set Referrer-Policy "strict-origin"
|
|
|
</IfModule>
|
|
|
```
|
|
|
|
|
|
### Nginx
|
|
|
```nginx
|
|
|
add_header Referrer-Policy "strict-origin";
|
|
|
```
|
|
|
|
|
|
## Various headers
|
|
|
|
|
|
In the same way that we added the `Content-Security-Policy` and `Referrer-Policy`, we can have :
|
|
|
* `X-Content-Type-Options: nosniff` to avoid XSS attacks through incorrect MIME types
|
|
|
* `X-XSS-Protection: 1; mode=block` to avoid XSS attacks for older browsers
|
|
|
|
|
|
You can also find other security tips here : <https://infosec.mozilla.org/guidelines/web_security> |
|
|
\ No newline at end of file |