security http headers

Security HTTP Headers The Missing M anual

Upload: chang-yu-sheng

Post on 21-Mar-2017

39 views

Category:

Technology

1 download

Report

Download

Embed Size (px):

TRANSCRIPT

Security HTTP HeadersThe Missing Manual

X-Content-Type-Options

X-Frame-Options

X-XSS-Protection

Content Security Policy

HTTP Strict Transport Security

Public Key Pinning

X-Content-Type-Options

X-Content-Type-Options: nosniff

nosniff

Demo

https://demo-page.csie.io/sniff.html

X-Frame-Options

X-Frame-Options: DENYX-Frame-Options: SAMEORIGINX-Frame-Options: ALLOW-FROM https://example.com

SAMEORIGIN, DENY or ALLOW-FROM <url>

Demo

https://demo-page.csie.io/frame.php

X-XSS-Protection

X-XSS-Protection: 0X-XSS-Protection: 1X-XSS-Protection: 1; mode=block

0/1 (; mode=block)

Content Security PolicyCSP

CSP

Level 1

Level 2

Level 3 Draft

http://cspisawesome.com

Demo

https://demo-page.csie.io/csp.php

HTTP Strict Transport SecurityHSTS

307 Internal Redirect

Strict-Transport-Security: max-age=31536000

max-age=<sec> (; includeSubDomains) (; preload)

Demo

https://www.cs.ccu.edu.tw

Public Key PinsHPKP

Public Key Pins: pin-sha256=“…”; max-age=15552000

pin-<algo>=“<value>”; max-age=<sec>

(; includeSubDomains)

(; report-uri=“<uri>”)

Q & A

Reference

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

http://caniuse.com

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Public-Key-Pins

https://hstspreload.appspot.com

Image Source

http://all4syria.info/wp-content/uploads/2016/06/15.png

http://www.tccpa.org.tw/mag/pages/201410/1-2.png

http://blog.smartbear.com/wp-content/uploads/2013/09/Internet_Explorer_10_logo.svg_.png

https://cdn1.vox-cdn.com/uploads/chorus_asset/file/3665120/Microsoft_Edge_logo.svg.0.png

https://lh4.googleusercontent.com/-gjxoCu8Fu3c/AAAAAAAAAAI/AAAAAAABV2s/G6QAFjz-5Zc/s0-c-k-no-ns/photo.jpg

https://lh6.googleusercontent.com/-fhrLO8TWc5o/AAAAAAAAAAI/AAAAAAAAP4E/qZBNhp3iREM/s0-c-k-no-ns/photo.jpg

https://upload.wikimedia.org/wikipedia/zh/6/61/Apple_Safari.png

http://www.zyhxfcyy.com/images/140120/2-14012015003IZ.jpg

http://www.ebestmobile.com/wp-content/uploads/2016/04/002tL3nWty6Hqufi4WTf3690.jpg

Thanks

Http Headers 與 Cache 機制

HTTP & Security

[Wroclaw #4] Web Application Security Headers-2 (HSTS, HPKP)

Fulfilling the Hypermedia Constraint via HTTP OPTIONS, The HTTP Vocabulary In RDF, And Link Headers

Mobile networks: exploiting HTTP headers and data traffic - DefCamp 2012

Output Buffers Control and HTTP Headers

GENERATING THE SERVER RESPONSE HTTP RESPONSE HEADERS · know how to use the status line and response headers effectively, not just how to gen-erate the document. Setting the HTTP

Cookies COEN 351 E-commerce Security. Client / Session Identification HTTP Headers Client IP Address HTTP User Login FAT URLs Cookies

CSP and HTTP Headers - NCDevConncdevcon.com/.../2015/CSP_and_HTTP_Headers-NCDevCon... · • OWASP Zed Attack Proxy (ZAP) Evangelist • Security Certifications - CEH, GWAPT. About

HANDLING THE CLIENT REQUEST HTTP REQUEST HEADERS · 2011-04-07 · request headers. It explains the most important HTTP 1.1 request headers, summa-rizing how and why they would be

HANDLING THE CLIENT REQUEST HTTP REQUEST HEADERS · request headers. It explains the most important HTTP 1.1 request headers, summa-rizing how and why they would be used in a servlet

Headers and Cookies - digi.ninja · Main Headers • X-Content-Type-Options • X-Frame-Options • X-XSS-Protection • Referrer-Policy • Strict-Transport-Security • Content-Security-Policy

Code.tutsplus.com-HTTP Headers for Dummies

Protec'ng Java EE Web Apps with Secure HTTP Headers

IPv6 Extension Headers and Network Security

Http request-headers

Security Impacts of Abusing IPv6 Extension Headers - Into.the.Void

Dirk Wetter -- Security and Insecurity of HTTP Headers · • MIME sniffing! Ignored Content-Type completely –Similar unix file (or MIME libs file uploads)→ • User controlled

HTTP Security Headers You Need To Know - WordPress.com · browser what security rules to enforce when it handles your websites content. •Key value pairs •In general, the more

Covert Timing Channels using HTTP Cache Headers

[MS-WSSHP]: HTTP Windows SharePoint Services Headers Protocol Specification

Csp and http headers

Analysis of HTTP Security Headers in Turkey

Browser Security Model - Stanford University lectures on Web securityFour lectures on Web security Browser security model The browser as an OS and execution platform Basic http: headers,

presentation security testing · • What does the tooling landscape look like ... • Use of SSL and certiﬁcate settings, best practices for HTTP headers, extraneous content,

Securing your web application through HTTP headers

STET PSD2 API · 5. Client Server interaction examples In the following examples, HTTP headers for request and response are explicitly given only once. Then, only relevant HTTP headers

HANDLING THE CLIENT REQUEST HTTP REQUEST HEADERSpdf.coreservlets.com/HTTP-Request-Headers.pdf · 148 Chapter 5 Handling the Client Request: HTTP Request Headers © Prentice Hall and

HTTP Security Headers Every Java Developer Must Know

Handling the Client Request: HTTP Request Headers

HTTP Security Headers You Need To Know · browser what security rules to enforce when it handles your websites content. •Key value pairs •In general, the more security headers

jPrime Enterprise JavaScript What The Heck · Demo Hello World! HTTP Request Parameters HTTP Request Headers HTTP Session Attributes • HTTP Get • HTTP Upload User Role Database

Not your Fathers Java · GraphQL vs. REST REST One HTTP endpoint per Resource HTTP middleware/headers Send HTTP Request External API (Swagger, RAML) Client Navigation via HATEOAS

HTTP Security Headers Explained - WordPress.com · •The number of seconds the browser should enforce HSTS. 31,536,000 (1 year) is really common. •includeSubDomains •Apply the

[Wroclaw #2] Web Application Security Headers