[WIP] Update secure-headers align with best current practice #2543
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…odern browser but set it explicitly is fine
…ed header. xss filter is depreacted on all browser so there are no reason to serve it even if it intends to disable since there is no guarantee `0` behaves as expected. use in CSP
… with compatible status among browsers and allow more appropriate directive to customise
|
This is just an idea, but to avoid breaking changes, it might be good to create and operate options like "useHelmetDefault" or "useHonoDefault".
// To select a default value that includes this change
app.use(
'*',
secureHeaders({
useHonoDefault: true // Experimental and deprecate v5.0
})
)
// To select a current default value
app.use(
'*',
secureHeaders({
useHelmetDefault: true
})
)or import { honoHelmet } from 'hono/secure-headers'
app.use(honoHelmet()) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
closes: #2540
update headers in secure-headers middleware align with best practices.
Referrer-Policytostrict-origin-when-cross-originas I filed default referrer-policy for secure-headers middleware #2540 ,
no-refereralso makeoriginheader tonull.originheader is important for avoid unexpected api call from browser (which includes CSRF).there are no reason to hide referrer from same-origin, so change it to reasonable setting.
strict-origin-when-cross-originis currently default for modern browsers, but explicitly set it is fine.see also: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy
x-xss-protection is not fully standardized, deprecated, not recommended header. xss filter is depreacted on all browser so there are no reason to serve it even if it intends to disable since there is no guarantee
0behaves as expected. use CSP instead.see also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
there are no reason to shorten
Strict-Transport-Security's max-age.so what is the appropriate value ? => anything long value is fine basically.
in this case you can see the QPACK static table.
https://www.rfc-editor.org/rfc/rfc9204.html#name-static-table-2
the basic values are defined in this table, and qpack will compress it in 1byte on quic transport.
57 is fine here.
it's widely supported in browsers and allow more appropriate directive to customize.
And more.
Basically, "kichen-sink" headers are kind of bad practice.
From point of view of that, the headers below are also ignorable for me.
since only for old browser, or the Risks are not clear (secure for who ?).
X-Download-Options: noopen: it's for deprecated IEX-Permitted-Cross-Domain-Policies: none': it's for deprecated Flash / SilverlightI don't know it's really required. but don't have strong opinion to delete thought.
Author should do the followings, if applicable
yarn denoifyto generate files for Deno