28 Jul 2017

CSP v3 in WordPress?

CSP v3 in WordPress?

Based on my last post “SSL CERTIFICATION WITH CSP & HSTS” how to add CSP in WordPress?

Well, the short story of this v3 format of CSP, it’s easy with some know-how to implement it. In production mode, where “Analytics”, FBEvent are loaded via a .js file. It won’t work (At least for now, I’ll update the posts when I found the trick).

Let’s talk about the CSPv3 format. It’s far better than the CSPv2 format where you have to explicit tell the HTTP-Server which “sites” are allowed. In v3 you can use nonce, what a wonderful idea. In production mode, well you will find several problems, like Analytics won’t get loaded (document.createElement doesn’t have “nonce”), and I’m pretty sure if it will ever have! Code-Injection a.k.a facepalm. Site-Note: It would be not “Secure” if you can inject any code via console, why you want CSP at all… Of course you can trigger the Analytics code via WordPress injections, but this won’t be anymore async… Well complicated.

Now what I’ve came up by my research snipping a plugin together. First, make the mu-plugins folder, than add the plugin (Within the folder).

What it does?

It reads the complete output-buffer, and change it the script/style tags to a valid nonce tags. That’s it.

Errors/Limitation?

There are currently to many, any “HTML Optimizer” use the same process like this code (Yes, since the WP core-developer missed the inline-script or localization-scripts.. there are currently no another ways.). This means Autoptimize, W3-Cache etc. won’t work. WP-Admin throws many CSP Errors and the Media-Uploader Popup is showing.

 

06 Oct 2016

SSL Certification with CSP & HSTS

SSL Certification with CSP & HSTS

Are you ready for 2017 with your website using SSL Certification?

Last month Google announced it will have a major security update in Chrome (Version 56). The news is for security enthusiastic like us glad, when not even happy. Finally our beloved Browser is getting a Security update who shows everybody, do not use unprotected website!

So let’s start from the beginning. You most time are thinking, why should XY get your information when you visit website XY? Well for marketing reason? Knowledge (Website owner) from visitors is like your best friend, he knows how you scroll, click, referrer, PC specs etc..

You gonna say, that’s not a secret they can have those information. There is the problem! They can have those information, but not everyone else. With an insecure website (Without SSL Certification) you can not validate that this is really this website.

Example, couple days ago gave me my best friend a link (Where is right now blocked in Chrome), a website who is “coping” Facebook.com website, it looks like Facebook, but it isn’t. With a “Red-Warning-Bar” it’s obviously catching your attention that there is something wrong and you gonna drop that website immediately…

Now what is CSP and HSTS?

Both are a security technology, Content Security Policy (CSP) where protect your website and HSTS secure yours domain of using only HTTPS.

CSP: Example you own example.com and you have jQuery, CSS styles loaded via external files, but you haven’t any inline-styles or inline-javascript in your website. With CSP you strictly forbid to have those. (That’s just one feature who CSP comes with). Those policies you can protect your website more easily from being hi-jacked.

HTTP Secure Transport Security (HSTS), is a Web Server feature, to protect your domain to redirect the complete time period of your SSL-Certification to use only HTTPS.

Example of a HSTS header tag for Apache2:

Header always set Strict-Transport-Security "max-age=15768000"

Conclusion:

We are waiting for the new features in Chrome, and will highly recommend your business/blog or web app to activate SSL certification with CSP/HSTS activated. You can start now, or latest on December 31th 2016.