Need

Implementation of secure and properly configured HTTP headers

Context

• Usage of Python 3 for building and running Python applications
• Usage of Django for building web applications

Description

Non compliant code

        from django.http import HttpResponse

def some_view(request):
    response = HttpResponse()
    response['X-XSS-Protection'] = '1; mode=block' 
    return response
        
        

The code above represents a Django view function that sets the X-XSS-Protection HTTP header to 1; mode=block. This header is considered deprecated and can lead to stored XSS (Cross-Site Scripting) vulnerabilities.

The X-XSS-Protection header was originally introduced by Internet Explorer and later adopted by other browsers to stop pages from loading when they detected reflected cross-site scripting (XSS) attacks. However, this header is now deprecated and its use can introduce additional security vulnerabilities.

In the context of the code above, the application sets the X-XSS-Protection header for every response from the some_view function. This could potentially allow an attacker to exploit this vulnerability by injecting malicious scripts into stored data, leading to a stored XSS vulnerability.

Stored XSS vulnerabilities are particularly dangerous because they allow an attacker to inject malicious scripts that are permanently stored (persisted) by the server. When a user accesses a page that includes this untrusted data, the malicious script is then sent to the user's browser and executed.

In the case of the X-XSS-Protection header, the potential vulnerability arises because this header can be bypassed, allowing an attacker to perform successful XSS attacks even when this header is present. This is why it's recommended to not use this header and instead rely on modern and more secure headers like Content-Security-Policy.

Steps

• Remove the 'X-XSS-Protection' header from the response. This header is deprecated and can lead to stored XSS vulnerabilities.
• Instead of relying on the 'X-XSS-Protection' header, implement a strong Content Security Policy (CSP). CSP is a more modern and reliable method to prevent XSS attacks.
• Ensure that user inputs are properly sanitized and validated to prevent XSS attacks. This is the most effective way to prevent XSS vulnerabilities.
• Regularly update and patch your software to ensure you have the latest security features and fixes.

Compliant code

        from django.http import HttpResponse
from django.shortcuts import render

def some_view(request):
    response = render(request, 'template.html')
    response['Content-Security-Policy'] = "default-src 'self'"
    return response
        
        

The original code was setting the 'X-XSS-Protection' header in the HTTP response. This header is deprecated and can lead to stored XSS vulnerabilities.

The updated code removes the 'X-XSS-Protection' header and instead implements a Content Security Policy (CSP) header. The CSP header is a more modern and reliable method to prevent XSS attacks.

In the updated code, the 'Content-Security-Policy' header is set to "default-src 'self'". This policy allows resources to be loaded from the same origin (same scheme, host and port) and no where else. This helps to prevent XSS attacks as it restricts where resources can be loaded from, making it harder for an attacker to inject malicious content.

In addition to implementing CSP, it's important to ensure that user inputs are properly sanitized and validated to prevent XSS attacks. This is the most effective way to prevent XSS vulnerabilities.

Lastly, regularly updating and patching your software ensures you have the latest security features and fixes.

References

• 135. Insecure or unset HTTP headers - X-XSS Protection