Improve headers for security #4757

TommyTran732 · 2022-09-16T22:51:44Z

I added Permissions-Policy and Content-Security-Policy. I have tested these with the admin panel and FIDO2.
XSS filtering should be set to 0 as it could cause issues by itself according to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection.

HSTS should be preloaded and ~~include subdomains~~. I don't see a reason not to.

mkuron · 2022-09-17T06:11:43Z

We had previously decided to not do HSTS for subdomains because it would affect services on your domain other than Mailcow. I think that still holds, especially since it's near impossible to turn off HSTS later.

TommyTran732 · 2022-09-17T17:14:57Z

Mkay I removed the includeSubdomains part.

milkmaker · 2022-11-17T19:55:50Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

TommyTran732 · 2022-11-18T04:32:28Z

Please do not mark it as stale.

DerLinkman · 2022-11-22T12:53:49Z

How does reverse Proxies behave on that?

TommyTran732 · 2022-11-22T17:21:53Z

How does reverse Proxies behave on that?

I don't understand the question 0.0

DerLinkman · 2022-11-22T17:32:00Z

How does reverse Proxies behave on that?

I don't understand the question 0.0

No problem. Will Reverse Proxies still work with that changes? As these are changed directly at the root webserver.

I´m not that fit with those security headers that´s why i ask + to ensure the functionality with reverse proxies.

TommyTran732 · 2022-11-26T03:01:53Z

No problem. Will Reverse Proxies still work with that changes? As these are changed directly at the root webserver.

It works fine with Mailcow on the stable branch. I have not tested with SOGo yet, as I do not use it. I am using it on my own server as you can see here: https://mail.tommytran.io

TommyTran732 · 2022-12-26T12:31:13Z

It should work with the bootstrap theme now

TommyTran732 · 2022-12-26T13:04:05Z

@DerLinkman These changes work fine with SOGo, I have tested them. They probably won't work with stuff like Gitea etc that you have in the docs. Maybe we can move them down to the location blocks to make it work. The other approach (and IMO the better approach) is to leave it like this and give instructions to overwrite the headers set at the root inside of the location blocks for those reverse proxies.

I have my CSP policy for Gitea listed here https://github.com/tommytran732/Gitea-Docker-Compose/blob/main/swag/nginx/ssl.conf#L32... I am not sure about the other stuff. Someone gotta make the CSP policies for them.

milkmaker · 2023-02-24T18:29:52Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

TommyTran732 · 2023-02-25T02:57:19Z

Do not close. It is not stale.

milkmaker · 2023-04-26T03:00:25Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

TommyTran732 · 2023-04-28T02:58:51Z

Do not close.

milkmaker · 2023-06-27T08:38:35Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

TommyTran732 · 2023-06-28T01:20:06Z

Do not close.

milkmaker · 2023-10-16T00:14:00Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

mkuron · 2023-10-16T18:21:23Z

data/conf/nginx/includes/site-defaults.conf

@@ -13,14 +13,18 @@
  ssl_session_timeout 1d;
  ssl_session_tickets off;

-  add_header Strict-Transport-Security "max-age=15768000;";
+  add_header Strict-Transport-Security "max-age=15768000; preload";


According to https://hstspreload.org, preload has no effect when includeSubDomains is not specified. And we definitely don't want that option as it has an effect outside of Mailcow.

I agree that it should be removed, a quote also from hstspreload.org:

If you maintain a project that provides HTTPS configuration advice or provides an option to enable HSTS, do not include the preload directive by default.

mkuron · 2023-10-16T18:25:34Z

data/conf/nginx/includes/site-defaults.conf

  add_header X-Content-Type-Options nosniff;
-  add_header X-XSS-Protection "1; mode=block";
+  add_header X-XSS-Protection "0";


Remove this option entirely. As per https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection, it is superseded by the Content-Security-Policy and not supported by any browser anymore.

mkuron · 2023-10-16T18:26:55Z

data/conf/nginx/includes/site-defaults.conf

  add_header X-Robots-Tag none;
  add_header X-Download-Options noopen;
  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header X-Permitted-Cross-Domain-Policies none;
  add_header Referrer-Policy strict-origin;
+  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), serial=(), usb=(), sync-xhr=(), xr-spatial-tracking=()";
+  add_header Content-Security-Policy "default-src 'none'; connect-src 'self' https://api.github.com https://www.gravatar.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https://www.gravatar.com; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content; base-uri 'none'";


Is this list still complete? The pull request is a year old, perhaps we now have different external dependencies?

I am still using this on my mailcow instance and have not had any issues. I can check later but I'd still expect it to work.

Signed-off-by: Tommy <[email protected]>

milkmaker · 2024-01-07T11:29:51Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

milkmaker · 2024-04-09T20:01:36Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

TommyTran732 · 2024-04-09T22:19:19Z

Do not close

milkmaker · 2024-06-09T00:17:32Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

TommyTran732 · 2024-06-09T08:30:21Z

Do not close

milkmaker · 2024-11-04T15:33:49Z

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

TommyTran732 · 2024-11-07T21:23:26Z

Do not close

Improve headers for security

61d61fe

Update site-defaults.conf

a7368ab

DerLinkman changed the base branch from master to staging September 18, 2022 19:02

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Nov 17, 2022

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Nov 18, 2022

Add more headers

5ad9ebc

Update CSP for bootstrap theme

2d4ed5c

DerLinkman added the needs testing label Dec 26, 2022

Fix gravatar

7b9e500

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Feb 24, 2023

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Feb 25, 2023

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Apr 26, 2023

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Apr 28, 2023

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Jun 27, 2023

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Jun 28, 2023

Add upgrade-insecure-requests;

3661cdc

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Oct 16, 2023

DerLinkman requested a review from mkuron October 16, 2023 06:56

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Oct 16, 2023

mkuron requested changes Oct 16, 2023

View reviewed changes

Opt out of Chrome's Topics API

7bb124c

Signed-off-by: Tommy <[email protected]>

DerLinkman added this to the 2023-11 milestone Nov 8, 2023

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Jan 7, 2024

DerLinkman modified the milestones: 2023-11, 2024 Jan 10, 2024

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Jan 10, 2024

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Apr 9, 2024

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Apr 9, 2024

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Jun 9, 2024

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Jun 9, 2024

milkmaker added the stale Please update the issue with current status, unclear if it's still open/needed. label Nov 4, 2024

milkmaker removed the stale Please update the issue with current status, unclear if it's still open/needed. label Nov 7, 2024

DerLinkman added the neverstale Bot doesn't mark the issue or PR as stale label Nov 8, 2024

DerLinkman force-pushed the staging branch from aaee040 to 4d688c5 Compare November 15, 2024 15:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve headers for security #4757

Improve headers for security #4757

TommyTran732 commented Sep 16, 2022 •

edited

Loading

mkuron commented Sep 17, 2022

TommyTran732 commented Sep 17, 2022

milkmaker commented Nov 17, 2022

TommyTran732 commented Nov 18, 2022

DerLinkman commented Nov 22, 2022

TommyTran732 commented Nov 22, 2022

DerLinkman commented Nov 22, 2022

TommyTran732 commented Nov 26, 2022

TommyTran732 commented Dec 26, 2022

TommyTran732 commented Dec 26, 2022 •

edited

Loading

milkmaker commented Feb 24, 2023

TommyTran732 commented Feb 25, 2023

milkmaker commented Apr 26, 2023

TommyTran732 commented Apr 28, 2023

milkmaker commented Jun 27, 2023

TommyTran732 commented Jun 28, 2023

milkmaker commented Oct 16, 2023

mkuron Oct 16, 2023

Derkades Sep 5, 2024

mkuron Oct 16, 2023

mkuron Oct 16, 2023

TommyTran732 Oct 24, 2023

milkmaker commented Jan 7, 2024

milkmaker commented Apr 9, 2024

TommyTran732 commented Apr 9, 2024

milkmaker commented Jun 9, 2024

TommyTran732 commented Jun 9, 2024

milkmaker commented Nov 4, 2024

TommyTran732 commented Nov 7, 2024

Improve headers for security #4757

Are you sure you want to change the base?

Improve headers for security #4757

Conversation

TommyTran732 commented Sep 16, 2022 • edited Loading

mkuron commented Sep 17, 2022

TommyTran732 commented Sep 17, 2022

milkmaker commented Nov 17, 2022

TommyTran732 commented Nov 18, 2022

DerLinkman commented Nov 22, 2022

TommyTran732 commented Nov 22, 2022

DerLinkman commented Nov 22, 2022

TommyTran732 commented Nov 26, 2022

TommyTran732 commented Dec 26, 2022

TommyTran732 commented Dec 26, 2022 • edited Loading

milkmaker commented Feb 24, 2023

TommyTran732 commented Feb 25, 2023

milkmaker commented Apr 26, 2023

TommyTran732 commented Apr 28, 2023

milkmaker commented Jun 27, 2023

TommyTran732 commented Jun 28, 2023

milkmaker commented Oct 16, 2023

mkuron Oct 16, 2023

Choose a reason for hiding this comment

Derkades Sep 5, 2024

Choose a reason for hiding this comment

mkuron Oct 16, 2023

Choose a reason for hiding this comment

mkuron Oct 16, 2023

Choose a reason for hiding this comment

TommyTran732 Oct 24, 2023

Choose a reason for hiding this comment

milkmaker commented Jan 7, 2024

milkmaker commented Apr 9, 2024

TommyTran732 commented Apr 9, 2024

milkmaker commented Jun 9, 2024

TommyTran732 commented Jun 9, 2024

milkmaker commented Nov 4, 2024

TommyTran732 commented Nov 7, 2024

TommyTran732 commented Sep 16, 2022 •

edited

Loading

TommyTran732 commented Dec 26, 2022 •

edited

Loading