OWASP Secure Headers Project - Revision history

Riramar: Adding DrHEADer

2019-11-06T12:57:07Z

Adding DrHEADer

2019-01-07T20:22:27Z

2019-01-07T20:21:38Z

2019-01-07T20:21:26Z

2018-12-26T23:17:48Z

Added Feature-Policy Header example to Apache config

2018-12-11T13:13:17Z

Add Secure for Python

2018-10-13T19:46:30Z

2018-08-23T18:19:16Z

2018-07-23T13:03:23Z

2018-07-23T12:59:44Z

‎Done

← Older revision		Revision as of 12:57, 6 November 2019
Line 744:		Line 744:
	</font>		</font>

		+	\|- valign="top"
		+	\| width="“50%”" style="border: 1.00pt solid #000001; padding: 0.18cm" \|
		+	'''DrHEADer'''
		+
		+	<font size="2" style="font-size: 9pt">
		+	DrHEADer helps with the audit of security headers received in response to a single request or a list of requests.
		+	</font>
		+
		+	\| width="“50%”" style="border: 1.00pt solid #000001; padding: 0.18cm" \|
		+	<font size="2" style="font-size: 9pt”">
		+	* Site: https://github.com/Santandersecurityresearch/DrHeader
		+	</font>

	\|}		\|}

@@ Line 26: / Line 26: @@
 == Project Leader ==
-[[User:Riramar | Ricardo Iramar]]
+[[User:Riramar | Ricardo Iramar]]<br>
 [[User:Amenezes | Alexandre Menezes]]

← Older revision		Revision as of 20:21, 7 January 2019
Line 27:		Line 27:

	[[User:Riramar \| Ricardo Iramar]]		[[User:Riramar \| Ricardo Iramar]]
		+	[[User:Amenezes \| Alexandre Menezes]]

	== Project Contributors ==		== Project Contributors ==

← Older revision		Revision as of 20:21, 7 January 2019
Line 31:		Line 31:

	[[User:Jmanico \| Jim Manico]]<br />		[[User:Jmanico \| Jim Manico]]<br />
−	~~[[User:Amenezes \| Alexandre Menezes]]~~

	== Related Projects ==		== Related Projects ==

@@ Line 1,356: / Line 1,356: @@
 ==<div id="fp_bp">Feature-Policy</div>==
+Disables camera, microphone, and payment API. More features can be added to restrict if desired (vr, midi, etc).
 * Apache
-:[update needed]
+:<code>Header set Feature-Policy: camera: 'none'; payment: 'none'; microphone: 'none'</code>
 * nginx

@@ Line 925: / Line 925: @@
 * Site: https://github.com/jsocol/commonware/
 * Site: https://github.com/sdelements/django-security
 </font>

@@ Line 1,405: / Line 1,405: @@
 * Perform public to scan websites and view stats regarding these headers. Automated scanning of the top 1m sites on the web; filtering of said sites to view stats across industries and countries; published database dumps for public consumption/tools; scanning of individual sites; comparing multiple scanned sites.
 * Consistent reports regarding this secure headers, their usage, any changes to existing headers.
-* Reorganize "Best Practices" tab and include a section for related security best practices around headers (e.g. "Remove Server Header" and "Remove X-Powered-By Header".
+* Reorganize "Best Practices" tab and include a section for related security best practices around headers (e.g. "Remove Server Header" and "Remove X-Powered-By Header").
 * Create a parser to grab the headers from https://scans.io and populate the MySQL database.

@@ Line 129: / Line 129: @@
 The HTTPS web server serves a list of public key hashes, and on subsequent connections clients expect that server to use one or more of those public keys in its certificate chain. Deploying HPKP safely will require operational and organizational maturity due to the risk that hosts may make themselves unavailable by pinning to a set of public key hashes that becomes invalid.  With care, host operators can greatly reduce the risk of [https://www.owasp.org/index.php/Man-in-the-middle_attack man-in-the-middle (MITM) attacks] and other false authentication problems for their users without incurring undue risk.
-Before implement HPKP please read this https://groups.google.com/a/chromium.org/forum/m/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ.
+Before implement HPKP please read this https://www.chromestatus.com/feature/5903385005916160.
 ===Values===

@@ Line 1,190: / Line 1,190: @@
 * [[#xpcdp_bp | X-Permitted-Cross-Domain-Policies]]
 * [[#rp_bp | Referrer-Policy]]
 ==<div id="hsts_bp">HTTP Strict Transport Security (HSTS)</div>==
@@ Line 1,307: / Line 1,309: @@
 ==<div id="rp_bp">Referrer-Policy</div>==
 * Apache

@@ Line 1,394: / Line 1,394: @@
 * Include X-Permitted-Cross-Domain-Policies under Headers and Best Practices tab.
 * Include Expect-CT header and update HPKP.
 __NOTOC__ <headertabs></headertabs>
 [[Category:OWASP Project]]