Skip to main content

Tuleap Community Edition development and releases are no longer public. You have until September 30th to download packages and sources in Tuleap project. You can contact the team if you need further assistance.

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #22619 Deploy a resource isolation policy
    Infos
    #22619
    Thomas Gerbet (tgerbet)
    2021-09-20 13:31
    2021-08-09 17:11
    24192
    Details
    Deploy a resource isolation policy

    The goal is to prevent external websites to access the resources served by a Tuleap instance. The only exception being the only resource that is supposed to be accessed cross-origin: the REST API.

    This is a strong defense in depth against CSRF, cross-site script inclusion and more generally against cross site leaks.

    Deploying such a policy is possible thanks to the fetch metadata headers that browsers send, see https://www.w3.org/TR/fetch-metadata/

    Other
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Under implementation
    Empty
    Attachments
    Empty
    References
    Referenced by request #22619

    Other

    gerrit #23643
    Display settings

    Follow-ups