Missing Security Headers in Website Configuration
Link : https://www.aigne.io/en
Brief Description: I found that this site is missing several important security headers: Content-Security-Policy, Referrer-Policy, and Permissions-Policy. The lack of these headers may increase security risks and reduce user privacy.
Details of Findings:
- Content-Security-Policy (CSP):
- Issue: The absence of a
Content-Security-Policyheader allows the site to load content from untrusted sources, increasing the risk of Cross-Site Scripting (XSS) attacks. - Potential Impact: XSS attacks can lead to user data theft, page manipulation, or execution of malicious scripts in the user’s browser.
- Recommended Fix: Add a
Content-Security-Policyheader to restrict resources to only trusted domains, for example:javascript cssCopy codeContent-Security-Policy: default-src 'self'; script-src 'self' https://trusted-scripts.com; object-src 'none'
- Referrer-Policy:
- Issue: Without a
Referrer-Policy, the browser sends the referrer URL information when the user navigates to other sites. This can reveal sensitive information in the URL to third parties. - Potential Impact: Sensitive data in URLs (e.g., query parameters or user IDs) might be leaked to external sites.
- Recommended Fix: Add a
Referrer-Policyheader to control what information is shared when users navigate away. A safe example:javascript perlCopy codeReferrer-Policy: no-referrer-when-downgrade
- Permissions-Policy:
- Issue: Without a
Permissions-Policy, the web application might give unrestricted access to device APIs (such as camera, microphone, location) without proper restrictions. - Potential Impact: This could be exploited by malicious or compromised content on the page to access device features without the user's explicit consent.
- Recommended Fix: Add a
Permissions-Policyheader to control which features are accessible on the site, for example:javascript luaCopy codePermissions-Policy: geolocation=(self), microphone=()
Steps to Reproduce:
- Visit the site using a browser (such as Chrome or Firefox).
- Open the developer tools (usually by pressing
F12), then go to the "Network" tab and refresh the page. - Select the main request for the page and check the "Headers" section to see the missing headers.
Security Impact: Without these three headers, the site may be more vulnerable to certain types of attacks, especially Cross-Site Scripting (XSS), data leakage when users navigate between sites, and unauthorized access to device features.
Recommended Solution: Add these three headers to the server configuration to strengthen the site’s security and increase protection against attacks and data leakage.