Add Content Security Policy headers

[François Marier]

To help limit the damage that content injection (e.g. XSS) could cause, Libravatar could expose the X-Content-Security-Policy headers and explicitly name the hosts where external content can come from (i.e. just *.libravatar.org on most pages and Identica and Gravatar on the photo import page).

It's built into Firefox 4 and later.

  https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html
  https://developer.mozilla.org/en/Introducing_Content_Security_Policy
  https://github.com/mozilla/django-csp

Also see bug #769738 for a similar type of browser-enforced security checks.

[François Marier (fmarier)]

This looks like a reasonable default policy:

  X-Content-Security-Policy: "allow 'self'; options inline-script; img-src 'self' http://cdn.libravatar.org https://seccdn.libravatar.org data:"

(see https://developer.mozilla.org/en/Security/CSP/CSP_policy_directives for the details)

However, these pages need exceptions:

- tools/check: needs to allow any third-party images
- account/import_photo: needs to allow Gravatar and Identi.ca images

[François Marier (fmarier)]

Ideally, it would be nice to have Apache add a default CSP header if there isn't one already in the response (i.e. Django hasn't returned one).

That way, we could override the default value of that header within Django by doing this:

  response = render_to_response('tools/check.html', {'form': form, 'data' : data}, context_instance=RequestContext(request))
  response['X-Content-Security-Policy'] = 'something else'
  return response

The problem however is that Apache mod_headers doesn't have an action that adds a header only if it didn't exist already:

  https://httpd.apache.org/docs/2.2/mod/mod_headers.html#header

and we can't use the 'merge' or 'add' actions because they use commas as separators whereas CSP requires semicolons :(

[François Marier (fmarier)]

http://feeding.cloud.geek.nz/2011/09/adding-x-content-security-policy.html