Stories
Slash Boxes
Comments

SoylentNews is people

posted by cmn32480 on Monday August 29 2016, @05:03AM   Printer-friendly
from the will-it-be-bloated? dept.

Mozilla has released a free tool that allows website developers and administrators to determine if they are using all available security technologies at their full potential.

The tool, named "Observatory," was developed by Mozilla Information Security Engineer April King in an effort to help the organization test its own domains. Observatory has now been made available to everyone along with its source code.

Observatory performs nearly a dozen tests, including Content Security Policy (CSP), Contribute.json, cookies, cross-origin resource sharing (CORS), HTTP Public Key Pinning (HPKP), HTTP Strict Transport Security (HSTS), redirections, subresource integrity, and X-Content-Type-Options, X-Frame-Options and X-XSS-Protection headers.

[...] "Observatory is currently a very developer-focused tool, and its grading is set very aggressively to promote best practices in web security. So if your site fails Observatory's tests, don't panic — just take a look at its recommendations and consider implementing them to make your site more secure," King said.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by NCommander on Monday August 29 2016, @12:40PM

    by NCommander (2) Subscriber Badge <michael@casadevall.pro> on Monday August 29 2016, @12:40PM (#394626) Homepage Journal

    While a browser is free to ignore security headers, in the case of XSS stuff, an attacker is injecting code into another site to make the victim's browser do X. Generally speaking, most people are going to be running a browser that will respect security headers.

    And the XSS stuff for SN is known; it was brought to our attention a week or so ago but I haven't had a chance to implement it as of yet. Notably, our dev site (observatory link [mozilla.org]) currently scores a B.

    --
    Still always moving
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2