{"action":"created","issue":{"url":"https://api.github.com/repos/prologic/web-security-checklist/issues/4","repository_url":"https://api.github.com/repos/prologic/web-security-checklist","labels_url":"https://api.github.com/repos/prologic/web-security-checklist/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/prologic/web-security-checklist/issues/4/comments","events_url":"https://api.github.com/repos/prologic/web-security-checklist/issues/4/events","html_url":"https://github.com/prologic/web-security-checklist/issues/4","id":246561082,"number":4,"title":"Suggestions","user":{"login":"ventz","id":901168,"avatar_url":"https://avatars3.githubusercontent.com/u/901168?v=4","gravatar_id":"","url":"https://api.github.com/users/ventz","html_url":"https://github.com/ventz","followers_url":"https://api.github.com/users/ventz/followers","following_url":"https://api.github.com/users/ventz/following{/other_user}","gists_url":"https://api.github.com/users/ventz/gists{/gist_id}","starred_url":"https://api.github.com/users/ventz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ventz/subscriptions","organizations_url":"https://api.github.com/users/ventz/orgs","repos_url":"https://api.github.com/users/ventz/repos","events_url":"https://api.github.com/users/ventz/events{/privacy}","received_events_url":"https://api.github.com/users/ventz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-07-30T04:07:50Z","updated_at":"2017-07-30T04:28:41Z","closed_at":null,"body":"One suggestion for the http-> https redirection:\r\n\r\nInstead of redirecting http -> https, serve https only and use hsts headers: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet\r\n\r\n(more general info about it: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)\r\n\r\n\r\nFor the back-end portion:\r\n\r\nI would add these modification in your \"ssl config\" equivalent for apache/nginx/haproxy/etc (ex: ssl.conf in apache):\r\n\r\nSSLHonorCipherOrder on\r\nSSLCipherSuite HIGH:!aNULL:!eNULL:!kECDH:!aDH:!RC4:!3DES:!CAMELLIA:!MD5:!PSK:!SRP:!KRB5:@STRENGTH\r\nSSLProtocol all -SSLv2 -SSLv3\r\nSSLSessionCache        shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)\r\nSSLSessionCacheTimeout  300\r\n\r\n^ This and the hsts will also get you an A+ on ssl labs (https://www.ssllabs.com/ssltest/)\r\n\r\n\r\nAt last, check out:\r\n\r\n* CSP (content secure policy) header\r\n* the XFO (x-frame-options) header\r\n* the \"x-xss\" protection header.\r\n* the \"x-content-type-options\" header\r\n\r\nAll of these mentioned here: https://wiki.mozilla.org/Security/Guidelines/Web_Security\r\n\r\nAnother great scan: https://observatory.mozilla.org/"},"comment":{"url":"https://api.github.com/repos/prologic/web-security-checklist/issues/comments/318877545","html_url":"https://github.com/prologic/web-security-checklist/issues/4#issuecomment-318877545","issue_url":"https://api.github.com/repos/prologic/web-security-checklist/issues/4","id":318877545,"user":{"login":"prologic","id":1290234,"avatar_url":"https://avatars2.githubusercontent.com/u/1290234?v=4","gravatar_id":"","url":"https://api.github.com/users/prologic","html_url":"https://github.com/prologic","followers_url":"https://api.github.com/users/prologic/followers","following_url":"https://api.github.com/users/prologic/following{/other_user}","gists_url":"https://api.github.com/users/prologic/gists{/gist_id}","starred_url":"https://api.github.com/users/prologic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prologic/subscriptions","organizations_url":"https://api.github.com/users/prologic/orgs","repos_url":"https://api.github.com/users/prologic/repos","events_url":"https://api.github.com/users/prologic/events{/privacy}","received_events_url":"https://api.github.com/users/prologic/received_events","type":"User","site_admin":false},"created_at":"2017-07-30T04:28:41Z","updated_at":"2017-07-30T04:28:41Z","body":"I see :) Can you submit a PR for HSTS? :)"}}
{"actor":{"display_login":"prologic"}}