4 ms·
I'm an appsec person and security person. I'm surprised about the hundreds of people talking about CSP, HSTS, HPKP and it feels like I'm the only one talking ab
by ejcx 9y ago
I'm an appsec person and security person. I'm surprised about the hundreds of people talking about CSP, HSTS, HPKP and it feels like I'm the only one talking about insecurity headers.
Within the Alexa Top 1MM I discovered about ~1000 sites that had turned SAMEORIGIN policy off with their CORS configs [https://ejj.io/cost-of-security-headers/ https://ejj.io/cost-of-security-headers/] (including Atlassian/Bitbucket, Zulily, and several other big ones).
I asked Scott Helme to add looking for these problematic configs to securityheaders.io but didn't have any luck. I would love some help getting traction on this issue. CORS is fundamentally ... not good and people will keep getting it wrong unless people do something.
- 52-6F-62 9y agoI'm actually just coming across this at work. I work for a large media company and I'm petitioning in this capex round to build assistant (alexa, google assistant, siri, snips, etc) apps for the different brands including radio. The radio brands have streams that pass through Akamai into html and other sdk players that remove CORS protections, sometimes as the only way they function. Can you list a few good resources for dealing with these situations, or point a guy in the right direction?
- ivanr 9y agoHey Evan. CORS is on my todo list for Hardenize and will be added. We've done some work already, but it's hidden for now until I am certain our assessments are correct. Happy to work with you if you're interested. You have my email address!