998397 - X-Content-Type-Options header missing

Status: VERIFIED FIXED

(Marketplace Graveyard :: General, defect, P5)

Description

[karthic kumar]

Attachment: X-Content-Type-Options header missing in marketplace.png

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36

Steps to reproduce:

URL : https://marketplace.firefox.com/

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'


Actual results:

X CONTENT TYPE OPTIONS HEADER MISSING


Expected results:

This check is specific to Internet Explorer 8 and Google Chrome. Ensure each page sets a Content-Type header and the X-CONTENT-TYPE-OPTIONS if the Content-Type header is unknown

Comment 1

[Wil Clouser [:clouserw]]

Raymond - this has come up before.  Is this something we should add?

Comment 2

[karthic kumar]

ya you should add  x content type options header set to nosniff in configuration to prevent content sniffing

Comment 3

[karthic kumar]

need to set in the configuration  to prevent content sniffing

Comment 4

[Raymond Forbes[:rforbes]]

this is a pretty minor need, I would classify it as a "best practice".

i am pretty sure firefox doesn't even support this header at this time.

https://bugzilla.mozilla.org/show_bug.cgi?id=471020

Comment 5

[Ram Dayal Vaishnav [:ram]]

Hi Andy, it looks like this might not be very much clear to the newbie how to fix this. Can you put some information here for newbies so that they can pick this bug and fix it.

Thanks,
Ram

Comment 6

[Andy McKay]

Adding in HTTP Headers is likely a matter of altering the middleware in Django insert the header as mentioned. Here's a module that works with HTTP headers:

https://github.com/mozilla/zamboni/blob/master/mkt/site/middleware.py

Here is documentation on middleware:

https://docs.djangoproject.com/en/1.8/topics/http/middleware/

Comment 7

[purva]

I want to work on this

Comment 8

[Ram Dayal Vaishnav [:ram]]

Sure purva, assigning you to this bug. For any doubt, feel free to ask here or on #marketplace on irc.mozilla.org

Comment 9

[purva]

Hi Andy, Can you please elaborate on what do you want to convey through altering middleware?

Comment 10

[Ram Dayal Vaishnav [:ram]]

setting NI for comment 9

Comment 11

[Mathieu Pillard [:mat]]

You need to know python/Django for this one, and need to have set up Marketplace backend.

You need to modify one of the middleware classes we use or create one and add it to our settings (mkt/settings.py, MIDDLEWARE_CLASSES) to add this functionality. Andy gave a link to some middlewares we are already using that also deal with HTTP headers, as an example you can draw inspiration from.

Alternatively, instead of doing all this, you could add a dependency to http://django-secure.readthedocs.org/en/latest/index.html by adding django-secure to requirements/prod.txt, and following django-secure docs to install it. Then follow the same docs to enable/disable what we care about (for this bug, I'd disable everything except SECURE_CONTENT_TYPE_NOSNIFF, we can take care of the other settings in a different bug).

Comment 12

[Lavish Aggarwal]

Purva are you still working on this bug?

Comment 13

[purva]

No, I am pretty much stucked in this problem.

Comment 14

[Lavish Aggarwal]

Purva, Can I work on this bug? If you are not working on it?

Comment 15

[purva]

Yes...

Comment 16

[Ram Dayal Vaishnav [:ram]]

Cool, assigning this to Lavish.

Comment 17

[Lavish Aggarwal]

Hi [:mat]
Would it be okay to add a process_response method to the (/mkt/site/middleware.py, CommonMiddleware) to implement this functionality.

Comment 18

[Mathieu Pillard [:mat]]

Actually I'd prefer you add django-secure middleware, this is the better option for the future since django-secure is integrated in django 1.8.

Comment 19

[Lavish Aggarwal]

Attachment: patch to add x-content-type header

Please verify PR : https://github.com/mozilla/zamboni/pull/3295

Comment 20

[Mathieu Pillard [:mat]]

Fixed by Lavish in https://github.com/mozilla/zamboni/commit/6c2a93435e9e034e2325e98c4b2b732e8c5cdfc8

Thanks!

Comment 21

[Lavish Aggarwal]

Attachment: patch modified to add x-content-type header : nosniff

Comment 22

[karthic kumar]

any bounty or swag for this bug

Comment 23

[Victor Carciu]

Verified as fixed : http://screencast.com/t/4HuFUQrcXky

Comment 24

[Ram Dayal Vaishnav [:ram]]

(In reply to karthic kumar from comment #22)
> any bounty or swag for this bug

Hi Karthic,
The bounty is for Security bugs only (more info - https://www.mozilla.org/en-US/security/bug-bounty/). I am not sure how much you know about our contribution opportunities with Mozilla (or if you are already a volunteer), By the way, you can read about them at https://www.mozilla.org/en-US/contribute/ & you are most welcome to join volunteers (a lot of swags are waiting you there).

You can contact me or any of existing contributors if required. Find more mozillians at -
https://mozillians.org/
https://reps.mozilla.org/

Thanks,
Ram