4 ms·
Got an F because I didn't implement XSS protection on my static non-interactive non-JS website.
by ajnin 5y ago
Got an F because I didn't implement XSS protection on my static non-interactive non-JS website.
- IggleSniggle 5y agoTo be fair, you don’t need JS in the exploited website to do XSS.
- calcifer 5y agoBut they also said non-interactive, so I'm assuming no forms of any kind either.
- IggleSniggle 5y agoTrue. Although…you could also potentially use reflected URLs or cookies to pull off some kind of XSS attack.
- schemescape 5y agoI just confirmed this on my own static site which has no forms or any input whatsoever (and no JavaScript, cookies, or external resources either). But I guess I wouldn’t use this tool on such a trivial site anyway.
- agilob 5y agoI moved my website from wordpress with 20 plugins, comments, disqus and lazy loaded images to static pages generated from markdown using Hugo. It's literally plaintext no JS, no tracking, no cookies at all. I got downgrade from B to D for not having CSP, XSS and XFrames protections. I don't even have forms or JS on my blog anymore. All content is loaded from 1 domain.
- chrismorgan 5y agoYeah, −60 for lacking Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and X-XSS-Protection is grossly excessive. As is declaring XFO “mandatory for all new websites, and all existing websites are expected to add support for [it] as soon as possible” <https://infosec.mozilla.org/guidelines/web_security#x-frame-options https://infosec.mozilla.org/guidelines/web_security#x-frame-...>. XFO is entirely unnecessary for stateless and actionless websites, CSP of no value on static sites that load no third-party resources, and the rest of them of no value on static sites. You could say they protect against man-in-the-middle attacks or attacks on your static file server (nginx or equivalent), but any competent MITM will modify headers, and with attacks on the static file server you’re hosed anyway. I also think they should significantly downgrade at least XFO (they last touched that descriptive document I quoted over three years ago), because the browsers that want it are all now obsolete (IE11 being the only one that’s even vaguely still in use) and entirely unsupported by many systems. I get 40⁄100, D⁺, because of this stuff, and I have not the slightest intention of changing it because I’m stubborn and know that I don’t need them. Well, it’s better than the 0⁄100 it gave me at the start of 2019, or the 20⁄100 back in 2016. It needs some sort of profile system for the rankings, so that you can say “anything”, “static site”, “static site with no third-party resources”, that sort of thing, and in the lattermost case have it say “OK, then we’ll just suggest CSP, XCTO, XFO and XXP rather than screaming about them”.
- geofft 5y agoI mostly agree with you, but I think the strongest argument in favor of using them anyway is that you might add state/actions/third-party resources to your website at some point, and adding those headers now is harmless and a way to make those changes safe.
- adamrezich 5y ago>I get 40⁄100 wholly unrelated but I had no idea about the existence of U+2044 FRACTION SLASH!
- metalliqaz 5y agosame here. I don't think this tool was designed for our use case
- Avamander 5y agoSome of those headers are deprecated anyways and people should be using Content Security Policy. It's silly to subtract points for not using a deprecated header.