b6fe07ecf8
Security headers are HTTP response headers, that when set increase the security of your application by restricting modern browsers from running easily preventable vulnerabilities. You can inspect your site using https://securityheaders.com/ This patch implements the following headers: - strict-transport-security - HSTS enforces the use of HTTPS - x-content-type-options - Stops the browser from changing the Content-Type - referrer-policy - Control what information a browser includes when it navigates from a page - content-security-policy - CSP protects sites from XSS attacks by controlling what resources a browser is able to load Only enabled if HTTPS in use. There is the option to extend to all haproxy services in the future, but as the headers are only used by browser there maybe limited benefit to doing this other than for keystone and console services. Each of the headers set should have no effect on the operation of the site apart from the CSP header. As the CSP header restricts what resources a browser is allowed to load, if for example a Openstack instance is using federated login, CSP will block the redirect. To fix the the admin will need to override the CSP, using `haproxy_horizon_csp` to set the allowed list of resources. Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/818532 Change-Id: Ia99da8e4687b0a1d440f86d1c8be723ce2bfe061
20 lines
1.1 KiB
YAML
20 lines
1.1 KiB
YAML
---
|
|
security:
|
|
- |
|
|
The following security headers were added to the haproxy Horizon service:
|
|
`strict-transport-security`, `x-content-type-options`, `referrer-policy`
|
|
and `content-security-policy`.
|
|
Care should be taken when deploying the `strict-transport-security` header,
|
|
as this header implements Trust on First Use security, meaning that
|
|
after a browser first visits the page the browser will enforce the use of
|
|
HTTPS until the max age time has expired.
|
|
For the time being the `strict-transport-security` `preload` token which
|
|
indicates that you are happy to have your site included in the HSTS preload
|
|
list that is built into browsers has been excluded.
|
|
The headers can be disabled by setting `haproxy_security_headers: []` and
|
|
the CSP (Content Security Policy) for Horizon can be overridden to support
|
|
things like federated login by setting `haproxy_horizon_csp`.
|
|
There is the option to extend to all haproxy services in the future, but as
|
|
the headers are only used by browsers there maybe limited benefit to doing
|
|
this other than for keystone and console services.
|