Recommended
Recommended
More Related Content
What's hot
What's hot (8)
Similar to HTTP Security Headers - Devoxx UA 18
Similar to HTTP Security Headers - Devoxx UA 18 (20)
Recently uploaded
Recently uploaded (20)
HTTP Security Headers - Devoxx UA 18
- 1. HTTPSecurity Headers How to make thebrowser help protect your users
- 2. HI, I’MTIM DE GRANDE Competence Lead Application Security Ordina Belgium @TimDG
- 5. Give me the page over HTTP HTTPS Icons by https://icons8.com/
- 6. HTTPS No, you should use HTTPS Icons by https://icons8.com/
- 7. HTTPS Give me the page over HTTPS Icons by https://icons8.com/
- 8. HTTPS OK, here’s your page. Icons by https://icons8.com/
- 9. HTTPS Give me the page over HTTP Icons by https://icons8.com/
- 10. HTTPS Give me the page over HTTP Give me the page over HTTP Icons by https://icons8.com/
- 11. HTTPS No, you should use HTTPS Icons by https://icons8.com/
- 12. HTTPS Give me the page over HTTP Give me the page over HTTPS Icons by https://icons8.com/
- 13. HTTPS Give me the page over HTTP OK, here’s your page Icons by https://icons8.com/
- 14. HTTPS OK, here’s your page Icons by https://icons8.com/
- 15. HSTS Strict-Transport-Security: max-age=31536000 HTTP Strict Transport Protocol
- 16. HSTS Strict-Transport-Security: max-age=31536000; includeSubDomains HTTP Strict Transport Protocol
- 17. HSTS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload HTTP Strict Transport Protocol
- 18. HSTS
- 19. HSTSTAKE AWAYS Definitely enable it Make sure your max-age is long enough Careful with includesubdomains Don’t use preload prematurely
- 20. CERTIFICATES
- 21. CERTIFICATES Here’s my certificate Icons by https://icons8.com/
- 22. CERTIFICATES
- 23. CERTIFICATES
- 24. CERTIFICATEPINNING By the way, only accept certificates: 64f618b9… 29b51e5f… Icons by https://icons8.com/
- 25. CERTIFICATEPINNING By the way, only accept certificates: 64f618b9… 29b51e5f… Icons by https://icons8.com/
- 26. CERTIFICATEPINNING By the way, only accept certificates: 64f618b9… 29b51e5f…OK, only: 64f618b9… 29b51e5f… Icons by https://icons8.com/
- 27. CERTIFICATEPINNING I now have a new certificate: 850ebc4335… Icons by https://icons8.com/
- 28. CERTIFICATEPINNING I now have a new certificate: 850ebc4335… Nope! That’s not in my list: 64f618b9… 29b51e5f… Icons by https://icons8.com/
- 30. CERTIFICATEPINNING TAKE AWAYS Do NOT use it for websites Only use it if you have a separate update channel for pins (e.g. mobile app)
- 33. EXPECT-CT Only accept certificates that have been published Expect-CT: max-age=31536000, enforce
- 34. EXPECT-CT Only accept certificates that have been published Expect-CT: max-age=31536000, enforce, report-uri="https://example.com"
- 35. EXPECT-CT
- 36. EXPECT-CT TAKE AWAYS Limited browser support at the moment Start out by only reporting Activate the enforce directive when it’s stable
- 38. CONTENT SECURITYPOLICY CSP header limits what can run on your page default-src img-src style-src font-src script-src media-src connect-src frame-src worker-src child-src manifest-src object-src
- 39. CONTENT SECURITYPOLICY CSP header limits a lot of things frame-ancestors form-action require-sri-for base-uri sandbox nonce
- 40. CONTENT SECURITYPOLICY Also supports report-uri directive Fails silently! Only visible in the dev console. Has a “Report-Only” variant: Content-Security-Policy-Report-Only
- 41. CSP TAKE AWAYS Good to have, hard to master Run it in “Report-Only” mode for a while Keep monitoring the reports
- 42. OVERVIEW HTTPS is good. Use it!
- 43. OVERVIEW Use HSTS to tell the browser that you want a secure connection.
- 44. OVERVIEW HPKP (certificate pinning) is useful for mobile apps. Do NOT use it on your website.
- 45. OVERVIEW Enable Expect-CT to reduce MitM possibilities
- 46. OVERVIEW Content-Security-Policy tells the browser what the page is allowed to do. And what it isn’t.
- 47. QUESTIONS?
Editor's Notes
- HTTP no longer considered secure HTTPS is cheap (letsencrypt) and faster (HTTP/2)
- Enables HSTS for 1 year Refreshed every time the browser sees it Should be fine for most usecases (exception e.g. taxonweb)
- Include subdomains for HTTPS Careful though -> all subdomains might possibly break internal stuff (e.g. old printer with an http only management interface on printer.example.com)
- Allow preloading
- Preloading is an end goal. Removal from the list is a manual process, which will take time. Site is eligible when It has a valid certificate Redirects to https Serves al subdomains on https HSTS max-age at least 1 year HSTS preload active HSTS includesubdomains active
- Browser validates the certificate.
- 169 roots configured, your browser trusts all of them.
- CAs have to publish certificate info in logs Site admin should monitor those logs Careful, these logs are public!
- Enforce -> actually enforce the header.
- Report-uri -> sends a report of non-compliance to an endpoint of your choice e.g. reporturi.io Without enforce -> only reporting.