webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Added iframe CSP, improved session cookie security

Browse Source 
Added iframe CSP headers with configuration via .env.
Updated session cookies to be lax by default, dynamically changing to
none when iframes configured to allow third-party control.
Updated cookie security to be auto-secure if a https APP_URL is set.

Related to #2427 and #2207.
This commit is contained in:
Dan Brown
2021-01-02 02:43:50 +00:00
parent 588fd7d165
commit 92922288dd
7 changed files with 127 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
tests/SecurityHeaderTest.php Normal file
View File

@ -0,0 +1,71 @@
<?php namespace Tests;
use Illuminate\Support\Str;
class SecurityHeaderTest extends TestCase
{
public function test_cookies_samesite_lax_by_default()
{
$resp = $this->get("/");
foreach ($resp->headers->getCookies() as $cookie) {
$this->assertEquals("lax", $cookie->getSameSite());
}
}
public function test_cookies_samesite_none_when_iframe_hosts_set()
{
$this->runWithEnv("ALLOWED_IFRAME_HOSTS", "http://example.com", function() {
$resp = $this->get("/");
foreach ($resp->headers->getCookies() as $cookie) {
$this->assertEquals("none", $cookie->getSameSite());
}
});
}
public function test_secure_cookies_controlled_by_app_url()
{
$this->runWithEnv("APP_URL", "http://example.com", function() {
$resp = $this->get("/");
foreach ($resp->headers->getCookies() as $cookie) {
$this->assertFalse($cookie->isSecure());
}
});
$this->runWithEnv("APP_URL", "https://example.com", function() {
$resp = $this->get("/");
foreach ($resp->headers->getCookies() as $cookie) {
$this->assertTrue($cookie->isSecure());
}
});
}
public function test_iframe_csp_self_only_by_default()
{
$resp = $this->get("/");
$cspHeaders = collect($resp->headers->get('Content-Security-Policy'));
$frameHeaders = $cspHeaders->filter(function ($val) {
return Str::startsWith($val, 'frame-ancestors');
});
$this->assertTrue($frameHeaders->count() === 1);
$this->assertEquals('frame-ancestors \'self\'', $frameHeaders->first());
}
public function test_iframe_csp_includes_extra_hosts_if_configured()
{
$this->runWithEnv("ALLOWED_IFRAME_HOSTS", "https://a.example.com https://b.example.com", function() {
$resp = $this->get("/");
$cspHeaders = collect($resp->headers->get('Content-Security-Policy'));
$frameHeaders = $cspHeaders->filter(function($val) {
return Str::startsWith($val, 'frame-ancestors');
});
$this->assertTrue($frameHeaders->count() === 1);
$this->assertEquals('frame-ancestors \'self\' https://a.example.com https://b.example.com', $frameHeaders->first());
});
}
}