web_security | the learning notes of web security | Learning library

by jwcesign JavaScript Version: Current License: No License

X-Ray Key Features Code Snippets Community Discussions(2)Vulnerabilities Install Support

kandi X-RAY | web_security Summary

web_security is a JavaScript library typically used in Tutorial, Learning applications. web_security has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

the learning notes of web security

Support

Quality

Security

License

Reuse

Support

web_security has a low active ecosystem.

It has 8 star(s) with 2 fork(s). There are 2 watchers for this library.

It had no major release in the last 6 months.

web_security has no issues reported. There are no pull requests.

It has a neutral sentiment in the developer community.

The latest version of web_security is current.

Quality

web_security has no bugs reported.

Security

web_security has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

web_security does not have a standard license declared.

Check the repository for any license declaration and review the terms closely.

Without a license, all rights are reserved, and you cannot use the library in your applications.

Reuse

web_security releases are not available. You will need to build from source code and install.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of web_security

Get all kandi verified functions for this library.

web_security Key Features

No Key Features are available at this moment for web_security.

web_security Examples and Code Snippets

No Code Snippets are available at this moment for web_security.

Community Discussions

Trending Discussions on web_security

Website javascript works locally, but not on AWS

For which Content-Types should I set security related HTTP response headers?

QUESTION

Website javascript works locally, but not on AWS

Asked 2021-Mar-25 at 05:54

I'm hosting a static website on AWS (stored in S3, with CloudFront + Lambda@Edge). I've added some basic javascript to respond to button clicks (since I will be sending the form data to AWS API Gateway using AJAX, etc), but the javascript only seems to work locally, not online.

To be specific, if you go to my website and click on the button, nothing happens, regardless of what you enter in the text field. But if you "View page source" and save it locally, it will respond as expected (alerts pop-up and text field changes color depending on whether or not id is valid).

I've used jslint and regex101 to check and clean my code. I've removed all CSS and unrelated content. I've also reproduced the problem on several devices and browsers (always works fine locally). I'm pretty new to AWS and Javascript, so maybe it's something basic, but I've hit a roadblock after several days. Any help would be much appreciated!

I'm reproducing the html below (for posterity):

...

ANSWER

Answered 2021-Mar-25 at 05:54

Well, a few key lessons I learned here:

Best way to debug (non-responsive) JavaScript is browser's More tools > Developer Tools > Console tab. Without this, I was flying blind.
The problem was not with the JavaScript, but rather with the security headers I was adding. I had followed this AWS article without a deep understanding of the directives, and they blocked my JavaScript.
Inline JavaScript is bad! Make sure you put all your scripts into a separate file. Maybe this is obvious to you, but I had to read this article to understand why. Plus I have seen many Stack Overflow questions with inline JavaScript, so I question if this is really well known...
Use the Mozilla Observatory and Google's CSP Evaluator to check and improve your website's security.

In the end, I used the following Content-Security-Policy headers:

Source https://stackoverflow.com/questions/66263718

QUESTION

For which Content-Types should I set security related HTTP response headers?

Asked 2019-Jul-30 at 15:39

I've built a web application (with my favourite language Fantom!) and am in the process of locking it down from XSS and other such attacks by supplying industry standard HTTP response headers.

My question is, for which responses should the headers be set?

I could set the headers for every response, but that seems pretty wasteful given most requests will be for images, fonts, stylesheets, etc.. The Content-Security-Policy in particular can get quite lengthy.

As a lot of the headers relate to the owning HTML page (and the Javascript contained within), I get the feeling most of them need only be set for HTML pages.

I've looked at various resources such as:

And while they explain what the headers do, they don't explain for which resources they should be used and served for!

I've made a list below of HTTP response headers and for which Content-Types I think they should be served with. But does anyone know if this is correct?

...

ANSWER

Answered 2018-Jan-09 at 17:16

Theoretically, only 'active' documents should need it much like the X-XSS-Protection header (related answer here from Info Security). As long as the policy is set on the main document (even through a Meta tag), external resources should be blocked based on that policy, not the policy on the external resource (easy to see when loading CDN files which almost certainly do not have your CSP, or any CSP, set).

So I would say your estimate is correct; text/HTML and XML absolutely should have it, anything that can execute Javascript. It shouldn't matter for static resources. They'll be blocked or allowed based on the main Document's CSP.

I will admit that personally I simply send them on all resources served directly from my server as I'd rather be paranoid than screw something up and the few dozen bytes per request don't appear to be a big impact especially on a site that doesn't serve a great deal of requests. And if your site does serve an extreme amount of requests...usually best to cut down on requests before trying to shrink your headers.

As with anything like this I'd be sure to test your specific implementation and try loading some resources the CSP should block. You never know when a browser implementation may be flawed (or more frequently, a typo or over/under eager application of your own rules).

Source https://stackoverflow.com/questions/48151455

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install web_security

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: