A quick note to myself – in Chrome you can check your HSTS headers for a site using:
chrome://net-internals/#hsts
This was a problem for me yesterday, and the UAT system I was configuring wasn’t visible to sites like https://securityheaders.io/ that I’d normally use.
I’ve talked about how to how to remove HTTP Headers that you don’t need from IIS – but there are some that you probably will want. This particular post is about the Content Security Policy (CSP).
I’m not going to describe what one is. @Scott_Helme has already described what a Content Security Policy is far better than I can. Rather, I’m going to describe how to figure out what your policy should be… Continue reading “Configuring a Content-Security-Policy”
IIS is, by default, a bit too damn chatty, which isn’t what you want if you’re trying to harden your server:
You can check this with a site like SecurityHeaders.io, which will review all your HTTP Headers for you. It’s very good, I recommend it.
Why would I need to tell the world what ASP version, webserver, etc. that I’m using? Isn’t this just helping potential attackers? Well, yes. How do you remove these headers, though? Continue reading “Removing Chatty IIS Headers”
In the rush to build a website, it’s pretty easy to overlook something as mundane as HTTP headers – until someone runs an automated pen-test against the site you’ve built and starts asking about why you’re not using them – or why you are. Then you have to run around quickly trying to fix this – and some of these tasks aren’t so easy.
All of this can be fixed with a little testing beforehand, and there is a nifty site called SecurityHeaders.io…
This will tell you:
What headers you’re using and probably shouldn’t. IIS seems determined to include lots of HTTP Headers that you don’t need. This just leaks information to someone who is potentially malicious, and wastes a little bandwidth.
What headers you should use. There are a number of slightly obscure security related headers, and some new (and good) ones, such as a Content Security Policy, or HTTP Public Key Pinning.
Also, for what it’s worth, SecurityHeaders.io is by a chap called Scott Helme – https://scotthelme.co.uk/ (@Scott_Helme). He’s written about a lot of this stuff quite extensively, and also has written report-uri.io, which as we’ll see is fantastically useful.
Other ways of seeing your HTTP Headers…
Andy Burns' Blog 