Aman-Mittal opened a new issue, #216:
URL: https://github.com/apache/fineract-backoffice-ui/issues/216
Part of the GA security hardening work.
## Summary
`deploy/nginx.conf` — the config the shipped container serves the
application with — sets no
security headers at all. A grep for `Content-Security-Policy`,
`Strict-Transport-Security`,
`X-Frame-Options`, `X-Content-Type-Options` and `Referrer-Policy` returns
zero matches.
## Business value
**These are the backstop for everything the application cannot control.**
The codebase is in good shape on the application side: no
`bypassSecurityTrust`, no `innerHTML`
sinks, no raw HTML rendering, and the GA check gates that so a single
careless commit cannot
remove it. But that only covers what this code does. Headers cover what a
browser will permit
regardless:
- **Without a CSP**, any injected string that does reach the DOM can load
and execute remote
script, and can exfiltrate to any host. With one, the same injection has
nowhere to send data.
- **Without `X-Frame-Options` / `frame-ancestors`**, the application can be
framed and
clickjacked — a real risk for a back office where a single click approves
or disburses money.
- **Without `nosniff`**, a response the server mislabels can be
reinterpreted as script.
- **Without `Referrer-Policy`**, account and client identifiers in the URL
leak to any external
host the user navigates to.
- **Without HSTS**, a first request over plain HTTP is interceptable.
A back office that moves money is exactly the deployment where these are
expected, and their
absence is the kind of thing a security review finds immediately.
## Scope
Set all five on the server block, with `always` so they are present on error
responses too — which
is where a reflected payload would land.
The CSP should not admit `unsafe-eval`: the AOT build does not need it, and
it would give an
injected string a route to execution. `unsafe-inline` is needed for styles
only, because Angular
emits component styles inline and there is no nonce plumbed through a static
file server; scripts
should not get it.
`connect-src` should allow the same origin only. A deployment whose Fineract
is on another host
adds that origin here as well as to the application's allow-list — the two
are deliberately
separate, so a browser-side setting alone cannot open a new destination.
## Acceptance criteria
- [ ] All five headers set, with `always`.
- [ ] The config passes `nginx -t`.
- [ ] The headers are observable on a real response from the container image.
- [ ] `npm run ga:check` reports this gate as passing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
