Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #22619 Deploy a resource isolation policy
    Actions
    Infos
    #22619
    Thomas Gerbet (tgerbet)
    2021-09-20 13:31
    2021-08-09 17:11
    24182
    Details
    Deploy a resource isolation policy

    The goal is to prevent external websites to access the resources served by a Tuleap instance. The only exception being the only resource that is supposed to be accessed cross-origin: the REST API.

    This is a strong defense in depth against CSRF, cross-site script inclusion and more generally against cross site leaks.

    Deploying such a policy is possible thanks to the fetch metadata headers that browsers send, see https://www.w3.org/TR/fetch-metadata/

    Other
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Under implementation
    Empty
    Attachments
    Artifact links
    Empty
    Empty
    References
    Referencing request #22619

    Git commit

    tuleap/tuleap/stable

    Deploy a resource isolation policy 163e37dfdc
    User avatar Thomas Gerbet (tgerbet) , 2021-09-20 11:50
    Referenced by request #22619

    Other

    gerrit #23643
    Display settings

    Follow-ups