security-headers | Go HTTP Middleware with dynamic CSP nonce | HTTP library

by srikrsna Go Version: v2.2.0 License: MIT

X-Ray Key Features Code Snippets(2)Community Discussions(10)Vulnerabilities Install Support

kandi X-RAY | security-headers Summary

security-headers is a Go library typically used in Networking, HTTP applications. security-headers has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

HTTP middleware for Go providing various security headers. It's 100% compatible with net/http package and various other routers. Requires a minimum of Go 1.7.

Support

Quality

Security

License

Reuse

Support

security-headers has a low active ecosystem.

It has 12 star(s) with 1 fork(s). There are 2 watchers for this library.

It had no major release in the last 12 months.

There are 0 open issues and 2 have been closed. On average issues are closed in 1 days. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of security-headers is v2.2.0

Quality

security-headers has no bugs reported.

Security

security-headers has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

security-headers is licensed under the MIT License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

security-headers releases are available to install and integrate.

Installation instructions are not available. Examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi has reviewed security-headers and discovered the below as its top functions. This is intended to give you an instant insight into security-headers implemented functionality, and help decide if they suit your requirements.

middleware adds the request headers to the middleware stack
Middleware returns a middleware for the CSP
RandNonce is a wrapper around rand . RandNonce
Crypto rand
Nonce returns the nonce value stored in the context .
WithNonce returns a context with the provided value .

Get all kandi verified functions for this library.

security-headers Key Features

No Key Features are available at this moment for security-headers.

security-headers Examples and Code Snippets

Security Headers,Usage,Static Headers

Lines of Code : 37

License : Permissive (MIT)

Copy

// main.go
func main() {
    mux := http.NewServeMux()

    s := &secure.Secure{
        STSIncludeSubdomains: true,
        STSPreload:           true,
        STSMaxAgeSeconds:     90,

        FrameOption: secure.FrameAllowFrom,
        FrameO

Security Headers,Usage,Dynamic Content Security Policy

Lines of Code : 15

License : Permissive (MIT)

Copy

func main() {
    mux := http.NewServeMux()

    csp := &secure.CSP{
        Value:      `object-src 'none'; script-src {{nonce}} 'strict-dynamic'; base-uri 'self'; report-uri https://example.com/_csp;`,
        ByteAmount: 8,
    }

    mux.Hand

Community Discussions

Trending Discussions on security-headers

adding security http headers to aws lambda function

Website javascript works locally, but not on AWS

How to export JSON list to Excel file

Python: how to show timestamp other than datetime function

How to enable CORS in ASP.net Core WebAPI

Remove Content-Length using AWS Lambda@Edge

B2C: AcquireTokenSilent fails for ADFS, works for local accounts

Edit / hide Nginx Server header under Alpine Linux

HTTP 2 / Server Push + Nginx. Limiting amount of files

How to inject default security headers with Spring Security

QUESTION

adding security http headers to aws lambda function

Asked 2021-Apr-15 at 23:19

We have a simple application structure that our ReactJs front-end make request to api gateway which does a proxy-integration with a lambda function. Since our api gateway is passing requests as they are without any modification and do the same when returning responses to customer so the place we are going to add http security headers would be in the lambda function itself. I have done some research on how it can be achived but all the answers I got searching in Google mention lambda@Edge+Cloudfront similar to this post which we do not use at all, does it mean we have to change our structure by adding these two things? Thanks.

...

ANSWER

Answered 2021-Apr-15 at 23:19

The article you reference assumes the backend is static (e.g. S3) and cannot set headers. That's why Lambda@Edge is used.

It sounds like your current setup should work without any changes... Did you try adding headers in the code?

I have this code working perfectly for the APIGW + Lambda (proxy integration) combo.

Source https://stackoverflow.com/questions/67113635

QUESTION

Website javascript works locally, but not on AWS

Asked 2021-Mar-25 at 05:54

I'm hosting a static website on AWS (stored in S3, with CloudFront + Lambda@Edge). I've added some basic javascript to respond to button clicks (since I will be sending the form data to AWS API Gateway using AJAX, etc), but the javascript only seems to work locally, not online.

To be specific, if you go to my website and click on the button, nothing happens, regardless of what you enter in the text field. But if you "View page source" and save it locally, it will respond as expected (alerts pop-up and text field changes color depending on whether or not id is valid).

I've used jslint and regex101 to check and clean my code. I've removed all CSS and unrelated content. I've also reproduced the problem on several devices and browsers (always works fine locally). I'm pretty new to AWS and Javascript, so maybe it's something basic, but I've hit a roadblock after several days. Any help would be much appreciated!

I'm reproducing the html below (for posterity):

...

ANSWER

Answered 2021-Mar-25 at 05:54

Well, a few key lessons I learned here:

Best way to debug (non-responsive) JavaScript is browser's More tools > Developer Tools > Console tab. Without this, I was flying blind.
The problem was not with the JavaScript, but rather with the security headers I was adding. I had followed this AWS article without a deep understanding of the directives, and they blocked my JavaScript.
Inline JavaScript is bad! Make sure you put all your scripts into a separate file. Maybe this is obvious to you, but I had to read this article to understand why. Plus I have seen many Stack Overflow questions with inline JavaScript, so I question if this is really well known...
Use the Mozilla Observatory and Google's CSP Evaluator to check and improve your website's security.

In the end, I used the following Content-Security-Policy headers:

Source https://stackoverflow.com/questions/66263718

QUESTION

How to export JSON list to Excel file

Asked 2020-Nov-15 at 14:43

I have json list like below, and I wanna export it into excel file using Python. Please advise.

Code:

...

ANSWER

Answered 2020-Nov-15 at 14:22

It seems that your code pretty works....

just pip install xlwt

Source https://stackoverflow.com/questions/64845453

QUESTION

Python: how to show timestamp other than datetime function

Asked 2020-Nov-15 at 02:22

I get below dictionary data from aws. In python, how can I get it show timestamp instead of datetime.datetime(2020, 10, 26, 10, 57, 19, 215000, tzinfo=tzlocal()) there?

Thanks,

{ "ConfigRuleName": "required-tags", "OrderingTimestamp": datetime.datetime( 2020, 10, 26, 10, 57, 19, 215000, tzinfo=tzlocal() ), "ResourceId": "arn:aws:cloudformation:us-east-1:553763988947:stack/es-edge-security-headers-kells/f1924880-8311-11ea-9a26-0af77bd56d08", "ResourceType": "AWS::CloudFormation::Stack", }

...

ANSWER

Answered 2020-Nov-15 at 02:22

Assuming you are using the normal definition of a timestamp you can just call the datetime timestamp function. This will give you a float representing seconds from the epoch (this is the norm for Python in C it would be an int).

So if you put in the line:

Source https://stackoverflow.com/questions/64840507

QUESTION

How to enable CORS in ASP.net Core WebAPI

Asked 2020-May-17 at 05:55

What I am trying to do

I have a backend ASP.Net Core Web API hosted on an Azure Free Plan (Source Code: https://github.com/killerrin/Portfolio-Backend).

I also have a Client Website which I want to make consume that API. The Client Application will not be hosted on Azure, but rather will be hosted on Github Pages or on another Web Hosting Service that I have access to. Because of this the domain names won't line up.

Looking into this, I need to enable CORS on the Web API side, however I have tried just about everything for several hours now and it is refusing to work.

How I have the Client Setup Its just a simple client written in React.js. I'm calling the APIs through AJAX in Jquery. The React site works so I know its not that. The Jquery API call works as I confirmed in Attempt 1. Here is how I make the calls

...

ANSWER

Answered 2019-Jun-09 at 00:37

Because you have a very simple CORS policy (Allow all requests from XXX domain), you don't need to make it so complicated. Try doing the following first (A very basic implementation of CORS).

If you haven't already, install the CORS nuget package.

Source https://stackoverflow.com/questions/44379560

QUESTION

Remove Content-Length using AWS Lambda@Edge

Asked 2020-May-03 at 13:37

I Have the following CloudFront setup via a AWS CloudFormation template:

...

ANSWER

Answered 2020-May-02 at 22:03

What's LambdaEventType? It should be viewer-response to edit CloudFront's response.

Your function should delete content-length and not Content-Length as the header names are expected to be lower case in the headers array.

Source https://stackoverflow.com/questions/61539544

QUESTION

B2C: AcquireTokenSilent fails for ADFS, works for local accounts

Asked 2020-Apr-02 at 14:43

We have set up AD FS as an identity provider in our B2C login flows. Interactive login works just fine, but whenever we execute acquireTokenSilent with MSAL-JS in our Single Page Applications (SPA), we get an error:

Refused to display 'https://mytenant.b2clogin.com...' in a frame because it set 'X-Frame-Options' to 'deny'.

This only happens for the implicit flow. Applications using the authorization code grant work just fine. Local accounts work with both flows. From reading up on the documentation, this should not happen because I should have a session.

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs#x-frame-options

Note that non-interactive logins can be performed via iFrame due to prior session level security that has been established.

What can I do to fix this error?

...

ANSWER

Answered 2020-Apr-02 at 14:43

After double checking my policies and the documentation, the error became obvious. For some reason, we had this code in our policy for the SAML technical profile:

Source https://stackoverflow.com/questions/60986935

QUESTION

Edit / hide Nginx Server header under Alpine Linux

Asked 2020-Mar-20 at 19:37

When I use curl --head to test my website, it returns the server information.

I followed this tutorial to hide the nginx server header. But when I run the command yum install nginx-module-security-headers , it returns yum: not found.

I also tried apk add nginx-module-security-headers, and it shows that the package is missing.

I have used nginx:1.17.6-alpine as my base docker image. Does anyone know how to hide the server from header under this Alpine?

...

ANSWER

Answered 2019-Dec-11 at 12:16

I found the alternate solution. The reason that it shows binary not compatible is because I have one nginx pre-installed under the target route, and it is not compatible with the header-more module I am using. That means I cannot simply install the third party library from Alpine package.

So I prepare a clean Alpine OS, and follow the GitHub repository to build Nginx from the source with additional feature. The path of build result is the prefix path you specified.

Source https://stackoverflow.com/questions/59189311

QUESTION

HTTP 2 / Server Push + Nginx. Limiting amount of files

Asked 2020-Jan-12 at 11:34

I'm configuring my server to work with HTTP 2 Server Push.

I could make it work, but or the browser or the nginx is limiting the amount of files to "push" in 10. I have a much bigger list of items (they are below).

Anyone knows if there is something in nginx that I need to config?

Chrome print below... Lok at the Initiator, only 10 items has the "push" Chrome network image

My environment is:

...

ANSWER

Answered 2020-Jan-06 at 04:00

I found the answer =D.

I found the config that i needed to change. It is the "http2_max_concurrent_pushes". I added http2_max_concurrent_pushes 100; in my nginx site config inside the "server" scope

Source https://stackoverflow.com/questions/59596820

QUESTION

How to inject default security headers with Spring Security

Asked 2019-Dec-17 at 15:28

I use Spring Security 5.1.6, and reading about security headers here;

Spring Security allows users to easily inject the default security headers to assist in protecting their application. The default for Spring Security is to include the following headers:

Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

but from this documentation it seems like these headers are not implicitly added, so I need to inject the default headers myself. Question is, can I do that in spring-security.xml, or must I do it in some other way?

...

ANSWER

Answered 2019-Dec-17 at 15:25

According to my understanding, the default headers are not set by default, one needs to include this in the spring-security.xml:

Source https://stackoverflow.com/questions/59376695

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install security-headers

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: