[Bug 43209] New: Add X-Content-Type-Options security headers
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43209 Bug ID: 43209 Summary: Add X-Content-Type-Options security headers Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: kyle@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Koha already sends X-Frame-Options: SAMEORIGIN on its responses but does not send X-Content-Type-Options. Without it a browser may MIME sniff a response and treat it as a content type other than the one declared, which can turn an otherwise harmless response into executable script and enable content type confusion attacks. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43209 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |kyle@bywatersolutions.com |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43209 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43209 --- Comment #1 from Kyle M Hall (khall) <kyle@bywatersolutions.com> --- Created attachment 202838 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202838&action=edit Bug 43209: Add the X-Content-Type-Options: nosniff response header Koha already sends X-Frame-Options: SAMEORIGIN on its responses but does not send X-Content-Type-Options. Without it a browser may MIME sniff a response and treat it as a content type other than the one declared, which can turn an otherwise harmless response into executable script and enable content type confusion attacks. This adds X-Content-Type-Options: nosniff everywhere Koha already sets X-Frame-Options: in C4::Output::output_with_http_headers and in the two header blocks in C4::Auth ( the login page and get_template_and_user ), so the staff client, the OPAC, and the login page all send it. An old report ( bug 23874 ) suggested nosniff broke the advanced cataloging editor, but that was a mixed content ( http on https ) problem, not nosniff, and it no longer reproduces. The editor's scripts, including the svc/cataloguing/framework JSONP call, are served as text/javascript, so nosniff does not block them. Test Plan: 1) Apply this patch 2) Restart all the things! 3) Run: curl -sI <staff-url>/cgi-bin/koha/mainpage.pl 4) Note the response includes X-Content-Type-Options: nosniff 5) Repeat for the OPAC and for a logged-out staff page ( the login page ) 6) Note all of them include the header! 7) Open the advanced cataloging editor ( Cataloging > Advanced editor ) 8) Note the editor still loads correctly! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43209 David Nind <david@davidnind.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Patch doesn't apply CC| |david@davidnind.com --- Comment #2 from David Nind <david@davidnind.com> --- The patch doesn't apply 8-(... -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org