Sécurisez votre site web avec les headers HTTP
▻https://www.vaadata.com/blog/fr/securiser-votre-site-web-avec-les-headers-http
Un résumé des #headers qui améliorent la #sécurité :
Strict-Transport-Security
CORS headers (Access-Control-Allow-Origin)
Content-Security-Policy
X-Content-Type-Options
X-XSS-Protection
Une présentation lumineuse du header CSP par Nicolas Hofmann :
▻https://www.nicolas-hoffmann.net/content-security-policy-parisweb-2015
Mise en place d’un #monitoring avec Report-URI + Report-Only
Pour le monitoring des notifications #CSP et #HPKP d’un site en production, un service en ligne gratuit :
►https://report-uri.io
Ironically, CSP is too efficient in some browsers — it creates bugs with bookmarklets. So, do not update your CSP directives to allow bookmarklets. We can’t blame any one browser in particular; all of them have issues:
Firefox
Chrome (Blink)
WebKit
Most of the time, the bugs are false positives in blocked notifications. All browser vendors are working on these issues, so we can expect fixes soon. Anyway, this should not stop you from using CSP.
▻https://www.smashingmagazine.com/2016/09/content-security-policy-your-future-best-friend
Par Nicolas Hofmann toujours, évangéliste CSP :)
The next major update for report-uri.io!
▻https://scotthelme.co.uk/better-performance-and-custom-subdomains-on-report-uri-io
I’ve just pushed the next major update to ►https://report-uri.io and there are some great new features that I’m really excited to be launching! The service has come a long way in the 12 months it’s been running and usage has soared. Here is your next batch of new features, upgrades and improvements!
Subdomains for everyone!
The use of report-uri.io has exploded in recent months and with thousands of sites reporting through the service, sending reports that number in the hundreds of millions a month, it’s fair to say that it handles a pretty hefty amount of traffic. The existing structure of the address that reports are sent to started to cause some problems. This is how it used to look:
▻https://report-uri.io/report/ScottHelme
As all of the traffic is being sent to the bare domain (...)