Compléments au htaccess #5703

https://htaccessbook.com/important-security-headers/

Important: before adding this code to your site, make sure to read through each technique as explained in corresponding sections above. There may be important notes and information that you need to understand regarding each particular directive included in this code snippet.

# Security Headers
<IfModule mod_headers.c>
	Header set X-XSS-Protection "1; mode=block"
	Header set X-Frame-Options "SAMEORIGIN"
	Header set X-Content-Type-Options "nosniff"
	Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
	Header set Referrer-Policy "same-origin"
	Header set Feature-Policy "geolocation 'self'; vibrate 'none'"
</IfModule>

Notons qu’on a déjà le Header set Content-Security-Policy ... sur IMG/ (sauf les pdfs)

https://htaccessbook.com/important-security-headers/ > Important: before adding this code to your site, make sure to read through each technique as explained in corresponding sections above. There may be important notes and information that you need to understand regarding each particular directive included in this code snippet. > ```apache # Security Headers <IfModule mod_headers.c> Header set X-XSS-Protection "1; mode=block" Header set X-Frame-Options "SAMEORIGIN" Header set X-Content-Type-Options "nosniff" Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" Header set Referrer-Policy "same-origin" Header set Feature-Policy "geolocation 'self'; vibrate 'none'" </IfModule> ``` Notons qu’on a déjà le `Header set Content-Security-Policy ...` sur IMG/ (sauf les pdfs)

Header set Referrer-Policy "same-origin"

si je comprend bien la doc, c'est pour éviter qu'un click indique au site destinataires d'où le clic provient.

Ok pourquoi pas, mais dans ce cas on supprimer aussi de nos propres statistiques l'origine des visites, non ?

> Header set Referrer-Policy "same-origin" si je comprend bien la doc, c'est pour éviter qu'un click indique au site destinataires d'où le clic provient. Ok pourquoi pas, mais dans ce cas on supprimer aussi de nos propres statistiques l'origine des visites, non ?

"strict-origin-when-cross-origin" pourrait être un bon compromis : on indique le site, mais pas la page. C'est d'ailleurs ce qui est par défaut sur les navigateurs aujourd'hui.

https://web.dev/i18n/fr/referrer-best-practices/#pourquoi-strict-origin-when-cross-origin-ou-plus-stricte

"strict-origin-when-cross-origin" pourrait être un bon compromis : on indique le site, mais pas la page. C'est d'ailleurs ce qui est par défaut sur les navigateurs aujourd'hui. https://web.dev/i18n/fr/referrer-best-practices/#pourquoi-strict-origin-when-cross-origin-ou-plus-stricte

Header set X-XSS-Protection "1; mode=block" semble pas indiqué au vu de https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection :

Chrome has removed their XSS Auditor
Firefox has not, and will not implement X-XSS-Protection
Edge has retired their XSS filter
This means that if you do not need to support legacy browsers, it is recommended that you use Content-Security-Policy without allowing unsafe-inline scripts instead.

`Header set X-XSS-Protection "1; mode=block"` semble pas indiqué au vu de https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection : ``` Chrome has removed their XSS Auditor Firefox has not, and will not implement X-XSS-Protection Edge has retired their XSS filter This means that if you do not need to support legacy browsers, it is recommended that you use Content-Security-Policy without allowing unsafe-inline scripts instead. ```

Labels Milestones

Compléments au htaccess #5703