krazkidd / snakem Goto Github PK

We have ESLint v8 as a dependency. In v9, the current config file format will become deprecated. We can opt-in to the new format now without upgrading the package.

I submitted the live site to the Mozilla Observatory and a number of issues were raised (see results below). We can start by checking the Uvicorn docs to see if these have built-in configuration settings, otherwise some other package(s) may be required.

Note that we should scan the API endpoints as a smoke test but the results should take into consideration this note from the FAQ:

Is the Mozilla Observatory useful for scanning non-websites, such as API endpoints?

The HTTP Observatory is designed around scanning websites, not API endpoints. This is not to say that it can't be used for API endpoints, just that the results may not reflect the actual security posture of the API.

Nevertheless, the various security headers expected by the HTTP Observatory shouldn't cause any negative impact for APIs that return exclusively data, such as JSON or XML. The recommended configuration for API endpoints is:

Content-Security-Policy: default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security: max-age=63072000
X-Content-Type-Options: nosniff

• Review CSP header
• Review X-Content-Type-Options header
• Review X-Frame-Options header
• Review X-XSS-Protection header
• Implement Referrer-Policy header
• Scan API endpoints