[WIP] Update secure-headers align with best current practice #2543
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
closes: #2540
update headers in secure-headers middleware align with best practices.
Referrer-Policy
tostrict-origin-when-cross-origin
as I filed default referrer-policy for secure-headers middleware #2540 ,
no-referer
also makeorigin
header tonull
.origin
header is important for avoid unexpected api call from browser (which includes CSRF).there are no reason to hide referrer from same-origin, so change it to reasonable setting.
strict-origin-when-cross-origin
is currently default for modern browsers, but explicitly set it is fine.see also: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy
x-xss-protection is not fully standardized, deprecated, not recommended header. xss filter is depreacted on all browser so there are no reason to serve it even if it intends to disable since there is no guarantee
0
behaves as expected. use CSP instead.see also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
there are no reason to shorten
Strict-Transport-Security
's max-age.so what is the appropriate value ? => anything long value is fine basically.
in this case you can see the QPACK static table.
https://www.rfc-editor.org/rfc/rfc9204.html#name-static-table-2
the basic values are defined in this table, and qpack will compress it in 1byte on quic transport.
57 is fine here.
it's widely supported in browsers and allow more appropriate directive to customize.
And more.
Basically, "kichen-sink" headers are kind of bad practice.
From point of view of that, the headers below are also ignorable for me.
since only for old browser, or the Risks are not clear (secure for who ?).
X-Download-Options: noopen
: it's for deprecated IEX-Permitted-Cross-Domain-Policies: none'
: it's for deprecated Flash / SilverlightI don't know it's really required. but don't have strong opinion to delete thought.
Author should do the followings, if applicable
yarn denoify
to generate files for Deno