Meshcentral: Security Enhancement : Content Security Policy

[Floche87]

I use MC over internet. That's why security is very important for me.

When i add this strict content security policies (add_header Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';";) to my nginx, MC doesn't work as expected.

I must add multiple 'unsafe-inline' in the directive but it is less secure

Is it possible to change MC for integrate strict content security policy ?

Thx

[Ylianst]

This is interesting. Yes, I will take a look at this.

[Ylianst]

This is the minimal header that works for me:

"Content-Security-Policy": "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"

Indeed, I need unsafe-inline for script and style because I use inline styles and scripts. I an adding this line to the "sample-config.json" for future reference. I will experiment with removing inline styles, but it would take a lot of work to remove inline scripts.

[Ylianst]

This is such a good idea, that I just published MeshCentral v0.4.0-n with the following HTTP headers enabled by default:

"X-Frame-Options": "sameorigin",
"Referrer-Policy": "no-referrer",
"X-XSS-Protection": "1; mode=block",
"X-Content-Type-Options": "nosniff",
"Content-Security-Policy": "default-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self'; media-src 'self'"

This should lock down security quite a bit. Feedback welcome.

[Ylianst]

Just published MeshCentral v0.4.0-o with binding for session cookie to the external IP address of the browser. I want to see how this goes, but this makes login cookies really strict. I may add an option to disable this if required.

[Floche87]

I use same http headers in my configuration of nginx and all works good.
For session cookies, i don't have noticed issues for the moment.
a great thank for you

[Allowee]

Just an heads-up:

I tried to use mesh on my older linux laptop at home yesterday and got the "because it violates the following Content Security Policy directive: “connect-src 'self'”" error.
This is because the old browser does not allow the https to ws protocol switch.

more info: https://github.com/Fyrd/caniuse/issues/5052

[Ylianst]

Oh! Thanks for the head-up... that is... ugly. Working on it now.

[Ylianst]

MeshCentral v0.4.1-g is now live with a fix for the "heads up". Let me know if it works.

[Ylianst]

I am going to close this issue since the new HTTP headers seems to work as expected. Please re-open or file a new issue if needed.

[Allowee]

Checked this morning, this is fixed.
Thank you