Secure cookies & X-Frame-Options

[luckow]

To get 100 points with https://siwecos.de/en/, I need two more options. Do you have any idea how to set the following options in Surfer?

• secure cookies: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
• X-Frame-Options:
  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

[nebulon]

@luckow what is missing regarding the cookie here?

For x-frame-options, this is obsolete and now done via CSP, see https://docs.cloudron.io/apps/#custom-csp how to configure that.

[sanduhrs]

@nebulon The cookies that are set aren't marked as secure.

Please also see: https://siwecos.de/wiki/Set-Cookie/EN

[jimcavoli]

@nebulon Also while X-Frame-Options is not as current as CSP, it's still considered best practice to get more complete coverage for that protection across browsers, especially older ones:

https://caniuse.com/contentsecuritypolicy2
https://caniuse.com/x-frame-options

At least, that's still the case for every audit and best practice list in the circles I'm in. It is still required by the latest ASVS 4.0.2 (criteria 14.4.7) as well (source: en / de). So I'd encourage both. While you're touching the session cookie, you can also probably go SameSite=Strict as well.

[nebulon]

I've published a new app package which now has strict and secure cookies.

Regarding the X-Frame-Options, we used to have that in the platform but decided against supporting it, due to the overlap with CSP and thus having caused inconsistency and confusion depending on what the app sets on its own.

[scooke]

@luckow Thanks for introducing me to this site (siwecos.de)!