Scan op security headers (CSP, Frame-options, XSS-prot etc.)

[halderen]

No description provided.

[halderen]

Decided by steeringcmte on 2017-01-19 to keep issue in icebox. Some items might be proper security related, but for others they might be outside of the scope of the InternetNL testing alltogether. Issue #180, actually would target most of the concerns of this issue.

[baknu]

See discussion per mail between SC members on 5th september 2017.

[baknu]

See below an overview of relevant HTTP security headers:

• X-Frame-Options: https://tools.ietf.org/html/rfc7034
• X-Content-Type-Options: https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-part-vi-beta-2-update/
• X-Xss-Protection: https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-iv-the-xss-filter/
• Referrer-Policy: http://www.w3.org/TR/referrer-policy/
• Strict-Transport-Security (HSTS): https://tools.ietf.org/html/rfc6797 (already implemented)
• Content-Security-Policy (CSP): http://www.w3.org/TR/CSP3/

[baknu]

Also see: https://infosec.mozilla.org/guidelines/web_security
We should check and discuss whether there are more headers to test than the above mentioned. Mozilla also tests Cross-origin Resource Sharing (CORS), Subresource Integrity en Cookies. The latter two do not seem to be headers.

[baknu]

HSTS, CSP and X-Frame-Options are recommened by NCSC in 'ICT-beveiligingsrichtlijnen voor Webapplicaties' anyway.

[gthess]

Live on dev.

New labels:

• detail web tls http-*
• results domain tls http-headers label

[baknu]

Add new category in correspondance with mockup option 3.

[gthess]

Live on dev.

New category for the security headers test is created for the website test (Application security & privacy options).

Relevant text labels are:

• base test website explain
• detail web appsecpriv *
• faqs content
• faqs appsecpriv content
• faqs appsecpriv title
• results further-testing web content
• test siteappsecpriv *

[gthess]

Current checks for the new headers:

• CSP
  • Header is present
• X-Frame-Options
  • Value is one of (deny, sameorigin, allow-from)
• X-Content-Type-Options
  • Value is nosniff
• X-Xss-Protection
  • Should be at least enabled (1)
• Referrer-Policy
  • Value is valid; one of (no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, sameorigin, strict-origin, strict-origin-when-cross-origin, unsafe-url)