Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
@hint/hint-strict-transport-security
Advanced tools
Readme
Strict-Transport-Security
header (strict-transport-security
)strict-transport-security
warns against serving resources over
HTTPS without strict-transport-security
header and validates the
header directives and their corresponding values.
Web security should be a critical concern for web developers. Unlike cross-site scripting (XSS) and SQL injection, the exploit of insufficient protection over the transport layer can be harder to picture in practice. If a website accepts a connection through HTTP and then redirects to HTTPS, it opens opportunities for a "man-in-the-middle" attack, when the redirect could be exploited and lead the user to a malicious site.
By specifying the Strict-Transport-Security
header along with
a max-age
value in the response, a website can declare that only
secure connections within the specified period will be accepted.
For future requests to the same domain via insecure connections,
the browser knows that it should never load the site using HTTP
and automatically converts all requests to HTTPS instead.
Notably, to prevent the Strict-Transport-Security
header from being
stripped by the attacker on the user’s first visit, major browsers
include a "pre-loaded" list of sites that must be loaded via HTTPS.
You can submit your domain name in the online form
to be included in the list. After being included, all insecure
connection requests will be disallowed. Use with great caution:
Before you decide to have your own domain included, make sure that
you can support HTTPS for all the subdomains and that you'll never
again need the insecure scheme.
More information about HTTP Strict Transport (HSTS), please see:
For a site served over HTTPS, this hint checks the following:
Strict-Transport-Security
header.max-age
directive.max-age
directive has a value that is longer than
18 weeks (10886400s).Strict-Transport-Security
header has repetitive directives.Strict-Transport-Security
header contains the preload
directive, this hint will first check the domain name against the
HTTP Strict Transport Security (HSTS) preload list
for the preload status, and then check whether this domain has
errors that would prevent preloading by calling the HSTS Preload
API endpoint. This check is disabled by default.Strict-Transport-Security
response header was not sent over HTTPS
:
HTTP/... 200 OK
...
Strict-Transport-Security
response header is sent with a max-age
value that is too short:
HTTP/... 200 OK
...
Strict-Transport-Security: max-age=1
Strict-Transport-Security
response header is sent without max-age
directive:
HTTP/... 200 OK
...
Strict-Transport-Security: maxage=31536000
Strict-Transport-Security
response header is sent with duplicate
includeSubDomains
directives:
HTTP/... 200 OK
...
Strict-Transport-Security: includeSubDomains; max-age=31536000; includeSubDomains
HTTP/... 200 OK
...
Strict-Transport-Security: max-age=31536000
HTTP/... 200 OK
...
Strict-Transport-Security: max-age=31536000; includeSubDomains
HTTP/... 200 OK
...
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Apache can be configured to serve resources with the
Strict-Transport-Security
header with a specific value
using the Header
directive, e.g.:
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>
Note that:
The above snippet works with Apache v2.2.0+
, but you need to have
mod_headers
enabled
in order for it to take effect.
If you have access to the main Apache configuration file (usually called httpd.conf
), you should add
the logic in, for example, a <Directory>
section in that file. This is usually the recommended way as
using .htaccess
files slows down Apache!
If you don't have access to the main configuration file (quite
common with hosting services), add the snippets in a .htaccess
file in the root of the web site/app.
For the complete set of configurations, not just for this rule, see the Apache server configuration related documentation.
IIS can be configured to serve resources with the Strict-Transport-Security
header with a specific value using the <customHeader> element
.
E.g.:
<configuration>
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Strict-Transport-Security" value="max-age=31536000"/>
</customHeaders>
</httpProtocol>
</system.webServer>
</configuration>
Note that:
web.config
of your
application.For the complete set of configurations, not just for this rule, see the IIS server configuration related documentation.
Yes, you can configure the value that max-age
is checked against
in the .hintrc
file. By default, this limit
is set as 18 weeks (10886400s);
E.g. The following configuration will change the max-age
value
limit to 123456
.
{
"connector": {...},
"formatters": [...],
"hints": {
"strict-transport-security": ["error", {
"minMaxAgeValue": 123456
}],
...
},
...
}
Also, you can configure the hint so that if the preload
directive is
included in the header, it will check whether this domain has errors
that would prevent preloading by calling the hstspreload api endpoint.
This validation is disabled by default.
E.g. The following configuration will enable the preload
validation.
{
"connector": {...},
"formatters": [...],
"hints": {
"strict-transport-security": ["error", {
"checkPreload": true
}],
...
},
...
}
This package is installed automatically by webhint:
npm install hint --save-dev
To use it, activate it via the .hintrc
configuration file:
{
"connector": {...},
"formatters": [...],
"hints": {
"strict-transport-security": "error",
...
},
"parsers": [...],
...
}
Note: The recommended way of running webhint is as a devDependency
of
your project.
FAQs
hint for best practices related to the usage of the Strict-Transport-Security response header
The npm package @hint/hint-strict-transport-security receives a total of 13,184 weekly downloads. As such, @hint/hint-strict-transport-security popularity was classified as popular.
We found that @hint/hint-strict-transport-security demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.