zaxbux / wn-securityheaders-plugin

Manage CSP, Referrer Policy, XSS Protection, Frame Options, Feature Policy, HSTS, Content Type Sniffing, and more

Security Headers

This Winter CMS plugin allows you to manage a variety of security HTTP headers for your application.

See your score at securityheaders.com

CSP Nonce

This plugin generates a cryptographic nonce (128 bits, base64 encoded) for each HTTP response. To use the CSP nonce, enable the 'nonce' source for a CSP directive and include the CSPNonce component on the layout or page you want to apply the nonce. A page variable named csp_conce will contain the base64 encoded nonce.

<script nonce="{{ csp_nonce }}">
	// ...
</script>

In Case Things Break

Enabling the Content Security Policy header or the Strict Transport Security (HSTS) header could break your site if they're not setup properly. In each case, there is a command to disable the headers.

To disable the CSP from the console:

artisan securityheaders:disable_csp

To disable HSTS from the console:

artisan securityheaders:disable_hsts

Headers by Controller

Different headers are applied to different routes, based on the controller used. The System and Backend controllers have limited security headers to avoid breaking functionality. For exmaple, the backend would require adding the unsafe-inline directive, effectivley making a CSP policy useless, so that header is not added.

System

The System\Classes\SystemController controller handles asset combining. These are the headers that may be sent:

• Strict-Transport-Security
• X-Frame-Options
• X-Content-Type-Options
• X-XSS-Protection

Backend

The Backend\Classes\BackendController controller handles the backend CMS. These are the headers that may be sent:

• Strict-Transport-Security
• X-Frame-Options
• X-Content-Type-Options
• X-XSS-Protection

CMS

The Cms\Classes\CmsController controller handles the frontend. These are the headers that may be sent:

• Strict-Transport-Security
• Referrer-Policy
• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• X-XSS-Protection
• Feature-Policy

---

Obselete Headers

These headers are available for configuration in case legacy browsers need to be supported, but they are not recomended if you only support current browser verions.

X-Frame-Options

The X-Frame-Options header has been obsoleted by the frame-ancestors directive from CSP Level 2 for supporting browsers.

X-XSS-Protection

This header is non-standard and support has been removed (or will never be present) in a majority of browsers. You can achieve better protection using a Content Security Policy. Currently supported in IE 11 and Safari (caniuse.com).

• Never implemented in Firefox
• Removed in Chrome 78
• Removed from Edge

wn-securityheaders-plugin's Issues

X-Content-Type-Options header set to incorrect value

Hi

X-Content-Type-Options is incorrectly set to 1 (the on/off value from the settings screen) instead of 'nosniff' - the only correct value.

GET / HTTP/1.1
Host: www.pontofx.com

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private
Date: Wed, 16 Sep 2020 23:37:31 GMT
Strict-Transport-Security: max-age=2592000
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: deny
X-Content-Type-Options: 1
X-XSS-Protection: 1; mode=block
Set-Cookie: october_session=eyJpdiI6Im9jdG5nR3BEYVdlaUhVSEthYXM5a0E9PSIsInZhbHVlIjoiK2dTRVhGR1wvN0piQ2lwMDlKQ1h6ZmoyeFkwUktEUHZkaUtibG1HMTQ5blpINmFlTlwvNGlwVGRXXC9yWTBrZUNDcDBJeTR1YzNtT2trd0ZXRkJaVzl0Uk9uV1BsS1Nmb1gzaHJmUGJoaVpOUG9qMmJzZllLS0dRbTdBTEptbk54eEciLCJtYWMiOiJkNmFiZjdhMTk3NWRkYWFlOWQwYjMwMjFlMjIxYmFiZDIwMGMyNmQ4ZWM1ZDhmOGE5YTAxZWU4YTM0ZmRiYmY5In0%3D; expires=Thu, 17-Sep-2020 01:37:31 GMT; Max-Age=7200; path=/; secure; httponly; samesite=strict

This can be fixed by changing line 121 in file classes/HeaderBuilder.php to

return new HttpHeader('X-Content-Type-Options', 'nosniff');

Long blocked URLs cause SQL error

When the blocked URL in a CSP report is longer than the max. allowed length of a varchar (191), it throws the following SQL error:

PDOException: SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'blocked_uri' at row 1 in /var/www/vhosts/website.tld/httpdocs/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOStatement.php:105

This error causes the CSP violation not to be stored in the database.

Possible solution: In the "zaxbux_securityheaders_reporting_csp" database table, change the "blocked_uri" column type from varchar to text.