libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

KEYCLOAK-4736 Extend security defenses with additional option to set the X-XSS-Protection header, block by default

Browse source
This commit is contained in:
Dominik Langenegger 2017-04-10 11:20:07 +02:00
parent bfd76d7813
commit 8840bc073f
4 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo3_1_0.java
View file

@ -40,6 +40,7 @@ public class MigrateTo3_1_0 implements Migration {
Map<String, String> browserSecurityHeaders = new HashMap<>(realm.getBrowserSecurityHeaders()); Map<String, String> browserSecurityHeaders = new HashMap<>(realm.getBrowserSecurityHeaders());
browserSecurityHeaders.put("xRobotsTag", "none"); browserSecurityHeaders.put("xRobotsTag", "none");
browserSecurityHeaders.put("xXSSProtection", "1; mode=block");
realm.setBrowserSecurityHeaders(Collections.unmodifiableMap(browserSecurityHeaders)); realm.setBrowserSecurityHeaders(Collections.unmodifiableMap(browserSecurityHeaders));
} }

2
server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
View file

@ -35,12 +35,14 @@ public class BrowserSecurityHeaders {
headerMap.put("contentSecurityPolicy", "Content-Security-Policy"); headerMap.put("contentSecurityPolicy", "Content-Security-Policy");
headerMap.put("xContentTypeOptions", "X-Content-Type-Options"); headerMap.put("xContentTypeOptions", "X-Content-Type-Options");
headerMap.put("xRobotsTag", "X-Robots-Tag"); headerMap.put("xRobotsTag", "X-Robots-Tag");
headerMap.put("xXSSProtection", "X-XSS-Protection");
Map<String, String> dh = new HashMap<>(); Map<String, String> dh = new HashMap<>();
dh.put("xFrameOptions", "SAMEORIGIN"); dh.put("xFrameOptions", "SAMEORIGIN");
dh.put("contentSecurityPolicy", "frame-src 'self'"); dh.put("contentSecurityPolicy", "frame-src 'self'");
dh.put("xContentTypeOptions", "nosniff"); dh.put("xContentTypeOptions", "nosniff");
dh.put("xRobotsTag", "none"); dh.put("xRobotsTag", "none");
dh.put("xXSSProtection", "1; mode=block");
defaultHeaders = Collections.unmodifiableMap(dh); defaultHeaders = Collections.unmodifiableMap(dh);
headerAttributeMap = Collections.unmodifiableMap(headerMap); headerAttributeMap = Collections.unmodifiableMap(headerMap);

2
themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties
View file

@ -124,6 +124,8 @@ content-type-options=X-Content-Type-Options
content-type-options-tooltip=Default value prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type (click label for more information) content-type-options-tooltip=Default value prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type (click label for more information)
robots-tag=X-Robots-Tag robots-tag=X-Robots-Tag
robots-tag-tooltip=Prevent pages from appearing in search engines (click label for more information) robots-tag-tooltip=Prevent pages from appearing in search engines (click label for more information)
x-xss-protection=X-XSS-Protection
x-xss-protection-tooltip=This header configures the Cross-site scripting (XSS) filter in your browser. Using the default behavior, the browser will prevent rendering of the page when a XSS attack is detected (click label for more information)
max-login-failures=Max Login Failures max-login-failures=Max Login Failures
max-login-failures.tooltip=How many failures before wait is triggered. max-login-failures.tooltip=How many failures before wait is triggered.
wait-increment=Wait Increment wait-increment=Wait Increment

7
themes/src/main/resources/theme/base/admin/resources/partials/defense-headers.html
View file

@ -36,6 +36,13 @@
</div> </div>
<kc-tooltip>{{:: 'robots-tag-tooltip' | translate}}</kc-tooltip> <kc-tooltip>{{:: 'robots-tag-tooltip' | translate}}</kc-tooltip>
</div> </div>
<div class="form-group">
<label class="col-md-2 control-label" for="xXSSProtection"><a href="https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#xxxsp" target="_blank">{{:: 'x-xss-protection' | translate}}</a></label>
<div class="col-sm-6">
<input class="form-control" id="xXSSProtection" type="text" ng-model="realm.browserSecurityHeaders.xXSSProtection">
</div>
<kc-tooltip>{{:: 'x-xss-protection-tooltip' | translate}}</kc-tooltip>
</div>
</fieldset> </fieldset>
<div class="form-group" data-ng-show="access.manageRealm"> <div class="form-group" data-ng-show="access.manageRealm">
<div class="col-md-10 col-md-offset-2"> <div class="col-md-10 col-md-offset-2">