[4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers #18301

zero-24 · 2017-10-10T22:14:16Z

Summary of Changes

Implement security http headers per default and create the possibility to add custom http headers.

This plugin bases on https://github.com/zero-24/plg_system_httpheader which does the same for 3.x

Testing Instructions

test your webseite using: https://securityheaders.io/ => The most if not all headers are missing
Install this PR.
discover the new plugin
check that the plugin is enabled if not enable it.
check the report here: https://securityheaders.io/ again.

You can also check the http header using the Network Tab of your Browser:

Per default this plugin set the following headers + values:

X-Frame-Options: SAMEORIGIN

More Infos: https://scotthelme.co.uk/hardening-your-http-response-headers/#x-frame-options

X-XSS-Protection: 1; mode=block

More Infos: https://scotthelme.co.uk/hardening-your-http-response-headers/#x-xss-protection

X-Content-Type-Options: nosniff

More Infos: https://scotthelme.co.uk/hardening-your-http-response-headers/#x-content-type-options

Referrer-Policy: no-referrer-when-downgrade

More Infos: https://scotthelme.co.uk/a-new-security-header-referrer-policy/

Expected result

After enabeling the default options the above mention headers are set.

Actual result

Joomla does not set any security headers.

Additional Infos

Give of the nature of the other headers we can not give a save default as they are very site specific. But atleast this plugin offers a easy to implement way to add the other headers using subforms.

Thanks for @SniperSister @wilsonge and @yvesh for the feedback on the first implementation ;)

Next todo's

Please test the plugin
We should review the language strings
We need to decide if the descriptions can stay or should be dropped.
Give your feedback.

Thanks.

brianteeman · 2017-10-10T22:18:33Z

administrator/language/en-GB/en-GB.plg_system_httpheader.sys.ini

+; License GNU General Public License version 2 or later; see LICENSE.txt, see LICENSE.php
+; Note : All ini files need to be saved as UTF-8
+
+PLG_SYSTEM_HTTPHEADER="System - HttpHeader"


brianteeman · 2017-10-10T22:21:23Z

If we are going to do this then we should be complete and also offer CSP and STS options.

Quy · 2017-10-10T22:25:08Z

plugins/system/httpheader/httpheader.php

+	protected $app;
+
+	/**
+	 * The list of the suported HTTP headers


change to supported

Quy · 2017-10-10T22:25:59Z

plugins/system/httpheader/httpheader.php

+	}
+
+	/**
+	 * The `setHttpHeaders` methode handle the setting of the configured HTTP Headers


Fix methode

To be clear this should be method without an e at the end

zero-24 · 2017-10-10T22:30:32Z

If we are going to do this then we should be complete and also offer CSP and STS options.

hmm the problem with that both things is that you can not set just one default option. But anleast for the csp there are planings beyond this PR / Plugin by the Joomla 4 team. So the system can generate a suggestion. But this should not stop this plugin as this prepare anything we can do from now.

Thanks for your other feedback. Commit is incoming 😄

brianteeman · 2017-10-10T22:32:13Z

Agree about the issue of the default. Although it is possible to have a default value that will pass the test (I've done it) it is a crazy value

wilsonge · 2017-10-10T22:38:16Z

@zero-24 do you want to add STS header into this PR - i think that one is pretty easy

@brianteeman i'm going to leave CSP for a later addition to this plugin - as you know from my experience at the sprint with https://github.com/wilsonge/joomla-cms/tree/csp it was lots of pain to have a half decent CSP - i'm going to keep plugging away at it. But in the mean time I think this gives us some quick wins whilst we think about things

brianteeman · 2017-10-10T22:38:36Z

Re the descriptions. All the descriptions that are just long winded ways of saying the same thing as the label can be removed.

zero-24 · 2017-10-10T22:40:50Z

@zero-24 do you want to add STS header into this PR - i think that one is pretty easy

Sure but what default value do you suggest? And as we don't force https on new sites it need to be per default disabled anyway.

zero-24 · 2017-10-10T22:41:52Z

All the descriptions that are just long winded ways of saying the same thing as the label can be removed.

Sure. The question is what are our target users. Does a "normal" enduser understand what the setting means or not?

wilsonge · 2017-10-10T22:48:12Z

Sure but what default value do you suggest? And as we don't force https on new sites it need to be per default disabled anyway.

I think we don't need on/off - we can use the main application values for force https? All we need to do is have the time till expires in the plugin which is configurable (by default probably a month - 2592000 seconds)

…ys overwrite the default values if they have the same name

zero-24 · 2017-10-10T23:12:36Z

I think we don't need on/off - we can use the main application values for force https? All we need to do is have the time till expires in the plugin which is configurable (by default probably a month - 2592000 seconds)

Please check https://github.com/joomla/joomla-cms/pull/18301/files#diff-660b387da9d45a7ecca4cd27e25b3280R126 is it that what you had in mind?

Should we include the includeSubDomains setting too?

I have skipped the option part and allow now to overwrite the values using the additional headers i think this keeps the options low.

wilsonge · 2017-10-10T23:44:14Z

Please check https://github.com/joomla/joomla-cms/pull/18301/files#diff-660b387da9d45a7ecca4cd27e25b3280R126 is it that what you had in mind?

Seems good to me!

Should we include the includeSubDomains setting too?

Umm I wouldn't do includeSubDomains - we're only concerned about the current Joomla site - no more

SniperSister · 2017-10-11T04:51:21Z

If i read this correctly, the default headers will be enabled even for updated 3.x installs, correct? If so, we should all have in mind that this might be experienced as a backwards breaking change for users that are running their site in an iframe (I know a number of hosts who implement "redirects where the original domain stays the same" using an iframe) and make sure that this is documented properly.

brianteeman · 2017-10-11T07:39:36Z

PLG_SYSTEM_HTTPHEADER_XFRAMEOPTIONS_DESC and the following descriptions are great examples of !eaningless strings. They don't say anything. And if your argument is that they are useful for less technical users then they are worse than useless as they are without any useful information (which should be in docs not tooltips anyway)

brianteeman · 2017-10-11T07:44:37Z

Default on will be a problem. No question about that.

brianteeman · 2017-10-11T07:49:22Z

#18301 (comment) no we can't use the force HTTPS value in global config. On a good server you do not (and should not) use that

…headers

wilsonge · 2018-01-22T21:51:32Z

Let's see how this goes for now :)

zero-24 · 2018-01-23T17:54:01Z

❤️

brianteeman · 2018-01-24T12:19:33Z

Is there a reason why all the language strings are in the .sys.ini language file and not spread across two language files as normal

zero-24 · 2018-01-24T21:18:39Z

see: #19449 @brianteeman

Timeforsmilin · 2018-08-30T07:38:49Z

Hello, I am not a coder, but you guys have hidden the csp and x-frame policies, which are creating duplicate entries, when someone uses alternate security software to protect a Joomla domain. Your csp entries are considered insecure, and may be creating a conflict that disables the administrator save/save&close/close button functions.

I haven't had my shared hosting website taken offline since installing this software https://securitycheck.protegetuordenador.com about 4 years ago. That is more than I can say for any Joomla development! I don't know if my sites were hacked from the shared hosting platform or not, but they have been fine since I have added that security.

Whatever you have created, please make it visible and adjustable, or remove it, as there are better options.

Regards,
Louis

ghost · 2018-08-30T07:42:50Z

@Timeforsmilin can you please open a new Issue? Comments on closed Issues didn't get much Notice.

dialanerd · 2023-04-12T08:06:33Z

What would cause this plugin to stop working?
Everything is enabled and it's the latest version.
None of the code is showing up on my website
I've uninstalled and reinstalled the plugin, but still no luck

Using Joomla 3 (to be upgraded), PHP8

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/18301.}

zero-24 · 2023-04-12T08:24:50Z

This here is the J4 version of the plugin this can not be installed into 3.x please use https://github.com/zero-24/plg_system_httpheader within J3.

After activation the plugin configuration has to be adjusted to meet your requirements feel free to follow: https://github.com/zero-24/plg_system_httpheader/blob/master/README.md

dialanerd · 2023-04-12T08:28:47Z

I'm already using use https://github.com/zero-24/plg_system_httpheader but it's not working and I don't understand why? From: Tobias Zulauf ***@***.***> Sent: Wednesday, April 12, 2023 9:25 AM To: joomla/joomla-cms ***@***.***> Cc: dialanerd ***@***.***>; Comment ***@***.***> Subject: Re: [joomla/joomla-cms] [4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers (#18301) This here is the J4 version of the plugin this can not be installed into 3.x please use https://github.com/zero-24/plg_system_httpheader within J3. After activation the plugin configuration has to be adjusted to meet your requirements feel free to follow: https://github.com/zero-24/plg_system_httpheader/blob/master/README.md - Reply to this email directly, view it on GitHub<#18301 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A6YTKUTKABVARNC4NMP2HNDXAZRF3ANCNFSM4D6STSPQ>. You are receiving this because you commented.Message ID: ***@***.******@***.***>>

dialanerd · 2023-04-12T08:37:33Z

I'm not seeing any of the plug-in's settings in my headers. From: Tobias Zulauf ***@***.***> Sent: Wednesday, April 12, 2023 9:25 AM To: joomla/joomla-cms ***@***.***> Cc: dialanerd ***@***.***>; Comment ***@***.***> Subject: Re: [joomla/joomla-cms] [4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers (#18301) This here is the J4 version of the plugin this can not be installed into 3.x please use https://github.com/zero-24/plg_system_httpheader within J3. After activation the plugin configuration has to be adjusted to meet your requirements feel free to follow: https://github.com/zero-24/plg_system_httpheader/blob/master/README.md - Reply to this email directly, view it on GitHub<#18301 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A6YTKUTKABVARNC4NMP2HNDXAZRF3ANCNFSM4D6STSPQ>. You are receiving this because you commented.Message ID: ***@***.******@***.***>>

zero-24 · 2023-04-12T08:39:08Z

Ok please create an issue on that repo and include some more details about what you have done, how the plugin configuration looks right now, what is the URL and what you expect. This is the repo for the J4 implementation. Thanks.

dialanerd · 2023-04-12T09:15:55Z

Will do, how / where do I do this? From: Tobias Zulauf ***@***.***> Sent: Wednesday, April 12, 2023 9:39 AM To: joomla/joomla-cms ***@***.***> Cc: dialanerd ***@***.***>; Comment ***@***.***> Subject: Re: [joomla/joomla-cms] [4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers (#18301) Ok please create an issue on that repo and include some more details about what you have done, how the plugin configuration looks right now, what is the URL and what you expect. This is the repo for the J4 implementation. Thanks. - Reply to this email directly, view it on GitHub<#18301 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A6YTKUWBTD7X5C3YWHSHWULXAZS3RANCNFSM4D6STSPQ>. You are receiving this because you commented.Message ID: ***@***.******@***.***>>

zero-24 · 2023-04-12T10:25:43Z

https://github.com/zero-24/plg_system_httpheader/issues please

zero-24 added 5 commits October 10, 2017 23:47

initial implemention of the new plg_system_httpheader

13c3195

add missing files

4582036

fix language file header

e0257b5

fix since tags

52dfc16

cleanline at the end of the file

a111a92

zero-24 added the Feature label Oct 10, 2017

zero-24 requested a review from wilsonge October 10, 2017 22:14

joomla-cms-bot added Language Change This is for Translators PR-4.0-dev labels Oct 10, 2017

brianteeman reviewed Oct 10, 2017

View reviewed changes

Quy reviewed Oct 10, 2017

View reviewed changes

plugins/system/httpheader/httpheader.php Outdated

protected $app;

/**

* The list of the suported HTTP headers

Copy link

Contributor

Quy Oct 10, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

change to supported

Quy reviewed Oct 10, 2017

View reviewed changes

brianteeman changed the title ~~[plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers~~ [4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers Oct 10, 2017

thanks @brianteeman & @Quy

772a112

fix a error drone found

52bb783

add STS + reduce the code + add the behavior that custom values allwa…

7320cba

…ys overwrite the default values if they have the same name

zero-24 added 9 commits December 14, 2017 18:05

Merge branch '4.0-dev' of github.com:joomla/joomla-cms into security-…

d69c433

…headers

Merge branch '4.0-dev' of github.com:joomla/joomla-cms into security-…

dd48f04

…headers

Merge branch '4.0-dev' of github.com:joomla/joomla-cms into security-…

5768ded

…headers

Merge branch '4.0-dev' of github.com:joomla/joomla-cms into security-…

fe3503e

…headers

Merge branch '4.0-dev' of github.com:joomla/joomla-cms into security-…

085c825

…headers

merge conflicts

afc5f75

Merge branch '4.0-dev' of github.com:joomla/joomla-cms into security-…

b4a753f

…headers

update extension id's and up to 4.0-dev

eadb926

Merge branch '4.0-dev' of github.com:joomla/joomla-cms into security-…

e94ef5d

…headers

wilsonge merged commit c71c11b into joomla:4.0-dev Jan 22, 2018

zero-24 deleted the security-headers branch January 23, 2018 17:53

zero-24 added this to the Joomla 4.0 milestone Jan 23, 2018

zero-24 mentioned this pull request Jan 23, 2018

[jorg] Is there a interest of implementing csp's for joomla.org joomla/joomla-websites#1111

Closed

zero-24 mentioned this pull request Jan 24, 2018

[4.0] Move the additional language strings in a separate file & fix postinstall #19449

Merged

zero-24 mentioned this pull request Apr 7, 2018

[4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers joomlagerman/joomla#379

Closed

dgrammatiko mentioned this pull request Jun 21, 2018

[4.0] Content Security Policy (CSP) Management Component #20686

Merged

ghost mentioned this pull request Aug 30, 2018

Content Security Policy directives #21914

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers #18301

[4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers #18301

zero-24 commented Oct 10, 2017 •

edited

Loading

brianteeman Oct 10, 2017

brianteeman commented Oct 10, 2017

Quy Oct 10, 2017

Quy Oct 10, 2017

brianteeman Oct 11, 2017

zero-24 commented Oct 10, 2017

brianteeman commented Oct 10, 2017

wilsonge commented Oct 10, 2017

brianteeman commented Oct 10, 2017

zero-24 commented Oct 10, 2017

zero-24 commented Oct 10, 2017

wilsonge commented Oct 10, 2017

zero-24 commented Oct 10, 2017

wilsonge commented Oct 10, 2017

SniperSister commented Oct 11, 2017

brianteeman commented Oct 11, 2017

brianteeman commented Oct 11, 2017

brianteeman commented Oct 11, 2017

wilsonge commented Jan 22, 2018

zero-24 commented Jan 23, 2018

brianteeman commented Jan 24, 2018

zero-24 commented Jan 24, 2018

Timeforsmilin commented Aug 30, 2018 •

edited

Loading

ghost commented Aug 30, 2018

dialanerd commented Apr 12, 2023

zero-24 commented Apr 12, 2023

dialanerd commented Apr 12, 2023 via email

dialanerd commented Apr 12, 2023 via email

zero-24 commented Apr 12, 2023

dialanerd commented Apr 12, 2023 via email

zero-24 commented Apr 12, 2023

[4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers #18301

[4.0] [plg_system_httpheader] Implement security http headers per default and create the posibility to add custom http headers #18301

Conversation

zero-24 commented Oct 10, 2017 • edited Loading

Summary of Changes

Testing Instructions

Expected result

Actual result

Additional Infos

Next todo's

brianteeman Oct 10, 2017

Choose a reason for hiding this comment

brianteeman commented Oct 10, 2017

Quy Oct 10, 2017

Choose a reason for hiding this comment

Quy Oct 10, 2017

Choose a reason for hiding this comment

brianteeman Oct 11, 2017

Choose a reason for hiding this comment

zero-24 commented Oct 10, 2017

brianteeman commented Oct 10, 2017

wilsonge commented Oct 10, 2017

brianteeman commented Oct 10, 2017

zero-24 commented Oct 10, 2017

zero-24 commented Oct 10, 2017

wilsonge commented Oct 10, 2017

zero-24 commented Oct 10, 2017

wilsonge commented Oct 10, 2017

SniperSister commented Oct 11, 2017

brianteeman commented Oct 11, 2017

brianteeman commented Oct 11, 2017

brianteeman commented Oct 11, 2017

wilsonge commented Jan 22, 2018

zero-24 commented Jan 23, 2018

brianteeman commented Jan 24, 2018

zero-24 commented Jan 24, 2018

Timeforsmilin commented Aug 30, 2018 • edited Loading

ghost commented Aug 30, 2018

dialanerd commented Apr 12, 2023

zero-24 commented Apr 12, 2023

dialanerd commented Apr 12, 2023 via email

dialanerd commented Apr 12, 2023 via email

zero-24 commented Apr 12, 2023

dialanerd commented Apr 12, 2023 via email

zero-24 commented Apr 12, 2023

zero-24 commented Oct 10, 2017 •

edited

Loading

Timeforsmilin commented Aug 30, 2018 •

edited

Loading