... | ... | @@ -30,9 +30,9 @@ The migration page handles: |
|
|
|
|
|
Advanced settings, like the SMTP credentials or the default poll duration, must be manually filled inside the file `app/inc/config.php` on the webserver.
|
|
|
|
|
|
## Apache
|
|
|
### Apache
|
|
|
|
|
|
### Clean URL
|
|
|
#### Clean URL
|
|
|
To have fancy URLs, activate URL rewriting by activating the provided `.htaccess` file, by renaming it from `htaccess.txt` to `.htaccess`:
|
|
|
|
|
|
```bash
|
... | ... | @@ -49,7 +49,7 @@ Then reload or restart the Apache server. |
|
|
|
|
|
You can also put everything that's into the `.htaccess` file directly into your VirtualHost file.
|
|
|
|
|
|
### Secure admin section
|
|
|
#### Secure admin section
|
|
|
|
|
|
The `/admin` folder shouldn't be open to anyone but the admin of the Framadate instance, you should secure it with `.htaccess` and `.htpasswd` files.
|
|
|
|
... | ... | @@ -67,7 +67,7 @@ Then create the `.htpasswd` file with the following command (you may need to ins |
|
|
sudo -u www-data htpasswd -bc /var/www/framadate/admin/.htpasswd user password
|
|
|
```
|
|
|
|
|
|
### Secure htaccess and htpassword
|
|
|
#### Secure htaccess and htpassword
|
|
|
|
|
|
In order to disallow read access to the `.htaccess` and `.htpasswd` files, you can add this section to the `.htaccess` file:
|
|
|
```apache
|
... | ... | @@ -78,12 +78,12 @@ ErrorDocument 403 "Forbidden" |
|
|
</FilesMatch>
|
|
|
```
|
|
|
|
|
|
### Secure server
|
|
|
#### HTTPS
|
|
|
#### Secure server
|
|
|
##### HTTPS
|
|
|
|
|
|
It is really advided to use HTTPS and make HTTP redirect to it. Use Let's Encrypt to obtain free certificates.
|
|
|
|
|
|
#### Content Security Policy
|
|
|
##### Content Security Policy
|
|
|
|
|
|
If you have access to the configuration of your Framadate web server, it is [a good practice](https://wiki.mozilla.org/Security/Guidelines/Web_Security#Content_Security_Policy) to return a `Content-Security-Policy` header as it prevents different types of XSS attacks.
|
|
|
|
... | ... | @@ -93,7 +93,7 @@ If you have access to the configuration of your Framadate web server, it is [a g |
|
|
</IfModule>
|
|
|
```
|
|
|
|
|
|
#### Referrer-Policy
|
|
|
##### Referrer-Policy
|
|
|
|
|
|
If someone clicks on an external link inside a survey, the website that link points to will get the survey address in the `Referer` HTTP header. With the `Referrer-Policy`, we can tweak which information is sent.
|
|
|
|
... | ... | @@ -104,21 +104,21 @@ If someone clicks on an external link inside a survey, the website that link poi |
|
|
```
|
|
|
|
|
|
|
|
|
## Nginx
|
|
|
### Nginx
|
|
|
|
|
|
|
|
|
### Secure server
|
|
|
#### Content Security Policy
|
|
|
#### Secure server
|
|
|
##### Content Security Policy
|
|
|
```nginx
|
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self'";
|
|
|
```
|
|
|
|
|
|
#### Referrer-Policy
|
|
|
##### Referrer-Policy
|
|
|
```nginx
|
|
|
add_header Referrer-Policy "strict-origin";
|
|
|
```
|
|
|
|
|
|
#### Various headers
|
|
|
##### Various headers
|
|
|
|
|
|
In the same way that we added the `Content-Security-Policy` and `Referrer-Policy`, we can have :
|
|
|
* `X-Content-Type-Options: nosniff` to avoid XSS attacks through incorrect MIME types
|
... | ... | |