hermes - 💡(How to fix) Fix feat(security): Add CSP and security response headers to dashboard web server [1 comments, 2 participants]

TL;DR

Add a middleware function to the hermes_cli/web_server.py to set industry-standard security response headers, including Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.

Guidance

• Identify the existing CORS middleware in hermes_cli/web_server.py and add a new middleware function after it to set the suggested security headers.
• Verify the implementation by checking the response headers of the dashboard web server using browser developer tools or command-line tools like curl.
• Test the dashboard features to ensure the added headers do not introduce any functional issues.
• Review the OWASP security headers best practices to understand the purpose and benefits of each added header.

Example

from flask import Flask, make_response

app = Flask(__name__)

# Existing CORS middleware...
# Add the new middleware function after it
@app.after_request
def add_security_headers(response):
    response.headers['Content-Security-Policy'] = 'default-src \'self\'; script-src \'self\'; style-src \'self\' \'unsafe-inline\'; connect-src \'self\' ws://localhost:* wss://localhost:*; frame-ancestors \'none\''
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['Referrer-Policy'] = 'no-referrer'
    return response

Notes

The suggested implementation assumes a Flask-based web server, as implied by the hermes_cli/web_server.py file. If the web server uses a different framework, the middleware function may need to be adapted accordingly.

Recommendation

Apply the workaround by adding the suggested middleware function to set the security response headers, as it is a low-risk, high-value security hardening measure that aligns with OWASP best practices.