1287197 - Implement proper HTTP security headers on mailman instances

Status: RESOLVED FIXED

(Infrastructure & Operations :: Infrastructure: Mail, task)

Description

[April King [:April]]

Ed, can you please implement the following headers on mail and lists?

Content-Security-Policy: frame-ancestors 'none'
Strict-Transport-Security: max-age=31536000
X-Frame-Options: DENY
X-Content-Type-Options: nosniff

It's my understanding that's simply fronted by Apache, so it would look like this:

Header set X-Frame-Options "max-age=31536000"

(and so on)

Thanks!

Comment 1

[Ed Lim [:limed]]

Probably can get to this next week (Friday, probably shouldn't do it right now)

Comment 2

[April King [:April]]

Thanks, Ed.  I appreciate it!  *tips her hat*

Comment 3

[Ed Lim [:limed]]

So I have a question about this

> X-Frame-Options: DENY

Wouldn't using SAMEORIGIN be safer? Just reading the docs here since I'm not familiar with some of these headers and I would like to be sure if I set these settings that I don't break the site

Comment 4

[April King [:April]]

Either one is fine; SAMEORIGIN is only needed if the site frames itself.  Either one prevents *other* sites from framing it.

Comment 5

[Ed Lim [:limed]]

Added these headers in apache config:

    # Security header [Bug 1287197]
    Header set Strict-Transport-Security "max-age=31536000"
    Header set X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "frame-ancestors 'self';"

Verified:

$ curl -I https://mail.mozilla.org/listinfo
HTTP/1.1 200 OK
Date: Mon, 18 Jul 2016 18:44:22 GMT
Server: Apache
X-Backend-Server: mailman1.mail.scl3.mozilla.com
Strict-Transport-Security: max-age=31536000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self';
Connection: close
Content-Type: text/html; charset=us-ascii

$ curl -I https://lists.mozilla.org/listinfo
HTTP/1.1 200 OK
Date: Mon, 18 Jul 2016 18:46:01 GMT
Server: Apache
X-Backend-Server: mailman2.mail.scl3.mozilla.com
Strict-Transport-Security: max-age=31536000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self';
Connection: close
Content-Type: text/html; charset=us-ascii

Also as a bonus I have disabled server signatures

Comment 6

[April King [:April]]

Thanks so much, Ed!