Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse

Cloudron Forum

Apps | Demo | Docs | Install

Secure cookies & X-Frame-Options

Scheduled Pinned Locked Moved Solved Surfer
6 Posts 5 Posters 348 Views
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • luckowL Offline
    luckowL Offline
    luckow translator
    wrote on last edited by
    #1

    To get 100 points with https://siwecos.de/en/, I need two more options. Do you have any idea how to set the following options in Surfer?

    • secure cookies: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
    • X-Frame-Options:
      https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

    Pronouns: he/him | Primary language: German

    nebulonN scookeS 2 Replies Last reply
    0
  • nebulonN Offline
    nebulonN Offline
    nebulon Staff
    replied to luckow on last edited by
    #2

    @luckow what is missing regarding the cookie here?

    For x-frame-options, this is obsolete and now done via CSP, see https://docs.cloudron.io/apps/#custom-csp how to configure that.

    S jimcavoliJ 2 Replies Last reply
    2
  • S Offline
    S Offline
    sanduhrs
    replied to nebulon on last edited by
    #3

    @nebulon The cookies that are set aren't marked as secure.
    siwecos-set-cookie.png

    Please also see: https://siwecos.de/wiki/Set-Cookie/EN

    1 Reply Last reply
    0
  • jimcavoliJ Offline
    jimcavoliJ Offline
    jimcavoli App Dev
    replied to nebulon on last edited by
    #4

    @nebulon Also while X-Frame-Options is not as current as CSP, it's still considered best practice to get more complete coverage for that protection across browsers, especially older ones:

    https://caniuse.com/contentsecuritypolicy2
    https://caniuse.com/x-frame-options

    At least, that's still the case for every audit and best practice list in the circles I'm in. It is still required by the latest ASVS 4.0.2 (criteria 14.4.7) as well (source: en / de). So I'd encourage both. While you're touching the session cookie, you can also probably go SameSite=Strict as well.

    nebulonN 1 Reply Last reply
    0
  • nebulonN Offline
    nebulonN Offline
    nebulon Staff
    replied to jimcavoli on last edited by
    #5

    I've published a new app package which now has strict and secure cookies.

    Regarding the X-Frame-Options, we used to have that in the platform but decided against supporting it, due to the overlap with CSP and thus having caused inconsistency and confusion depending on what the app sets on its own.

    1 Reply Last reply
    0
  • scookeS Offline
    scookeS Offline
    scooke
    replied to luckow on last edited by
    #6

    @luckow Thanks for introducing me to this site (siwecos.de)!

    A life lived in fear is a life half-lived

    1 Reply Last reply
    2

  • Login

  • Don't have an account? Register

  • Login or register to search.
  • First post
    Last post
0
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Login

  • Don't have an account? Register

  • Login or register to search.