{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/13455","labels_url":"https://api.github.com/repos/owncloud/core/issues/13455/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/13455/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/13455/events","html_url":"https://github.com/owncloud/core/pull/13455","id":54750447,"number":13455,"title":"Let users configure security headers in their Webserver","user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/5%20-%20To%20review","name":"5 - To review","color":"ededed"},{"url":"https://api.github.com/repos/owncloud/core/labels/Enhancement","name":"Enhancement","color":"02e10c"},{"url":"https://api.github.com/repos/owncloud/core/labels/Security","name":"Security","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/owncloud/core/milestones/31","labels_url":"https://api.github.com/repos/owncloud/core/milestones/31/labels","id":912160,"number":31,"title":"8.1-next","description":"","creator":{"login":"MorrisJobke","id":245432,"avatar_url":"https://avatars.githubusercontent.com/u/245432?v=3","gravatar_id":"","url":"https://api.github.com/users/MorrisJobke","html_url":"https://github.com/MorrisJobke","followers_url":"https://api.github.com/users/MorrisJobke/followers","following_url":"https://api.github.com/users/MorrisJobke/following{/other_user}","gists_url":"https://api.github.com/users/MorrisJobke/gists{/gist_id}","starred_url":"https://api.github.com/users/MorrisJobke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MorrisJobke/subscriptions","organizations_url":"https://api.github.com/users/MorrisJobke/orgs","repos_url":"https://api.github.com/users/MorrisJobke/repos","events_url":"https://api.github.com/users/MorrisJobke/events{/privacy}","received_events_url":"https://api.github.com/users/MorrisJobke/received_events","type":"User","site_admin":false},"open_issues":369,"closed_issues":149,"state":"open","created_at":"2014-12-22T12:04:01Z","updated_at":"2015-02-23T15:03:32Z","due_on":"2015-04-02T22:00:00Z","closed_at":null},"comments":15,"created_at":"2015-01-19T11:00:50Z","updated_at":"2015-02-23T16:58:29Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/owncloud/core/pulls/13455","html_url":"https://github.com/owncloud/core/pull/13455","diff_url":"https://github.com/owncloud/core/pull/13455.diff","patch_url":"https://github.com/owncloud/core/pull/13455.patch"},"body":"Doing this in the PHP code is not the right approach for multiple reasons:\r\n\r\n1. A bug in the PHP code prevents them from being added to the response.\r\n2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)\r\n3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.\r\n\r\nThis pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS. Sane defaults are also provided in our .htaccess\r\n\r\n<hr>\r\n# Testplan:\r\n- [ ] When mod_headers is enabled the headers are added accordingly and no security warning is shown (maybe except SSL)\r\n- [ ] When removing some of those headers warnings are shown\r\n- [ ] When using SSL no SSL warning except \"Strict-Transport-Security\" is shown\r\n- [ ] When using SSL in combination with \"Strict-Transport-Security\" no warning is shown\r\n\r\n<hr/>\r\n# TODO:\r\n- [x] Remove `X-Frame-Options` from the code and move to `.htaccess`\r\n   - [x] Add check to admin panel.\r\n- [x] Remove `X-XSS-Protection` from the code and move to `.htaccess`\r\n   - [x] Add check to admin panel.\r\n- [x] Remove `X-Content-Type-Options` from the code and move to `.htaccess`\r\n   - [x] Add check to admin panel.\r\n- [x] Remove `X-Robots-Tag` from the code and move to `.htaccess`\r\n   - [x] Add check to admin panel.\r\n- [x] Remove `forceSSL` from the code\r\n   - [x] Add check to admin panel.\r\n   - [x] Autodetect SSL situations and set cookies accordingly\r\n- [ ] Document changes and add a breaking change text on https://github.com/owncloud/core/wiki/ownCloud-8.1-Features\r\n\r\n<hr/>\r\n# Breaking changes\r\n- Admins now have to ensure that the security headers are properly configured in the webserver config\r\n- The `forcessl` and `xframe_restriction` config are gone and have to be replaced by custom HTTP headers by the admin\r\n\r\n<hr/>\r\n\r\nFixes https://github.com/owncloud/core/issues/14073"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/75582973","html_url":"https://github.com/owncloud/core/pull/13455#issuecomment-75582973","issue_url":"https://api.github.com/repos/owncloud/core/issues/13455","id":75582973,"user":{"login":"scrutinizer-notifier","id":6398257,"avatar_url":"https://avatars.githubusercontent.com/u/6398257?v=3","gravatar_id":"","url":"https://api.github.com/users/scrutinizer-notifier","html_url":"https://github.com/scrutinizer-notifier","followers_url":"https://api.github.com/users/scrutinizer-notifier/followers","following_url":"https://api.github.com/users/scrutinizer-notifier/following{/other_user}","gists_url":"https://api.github.com/users/scrutinizer-notifier/gists{/gist_id}","starred_url":"https://api.github.com/users/scrutinizer-notifier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scrutinizer-notifier/subscriptions","organizations_url":"https://api.github.com/users/scrutinizer-notifier/orgs","repos_url":"https://api.github.com/users/scrutinizer-notifier/repos","events_url":"https://api.github.com/users/scrutinizer-notifier/events{/privacy}","received_events_url":"https://api.github.com/users/scrutinizer-notifier/received_events","type":"User","site_admin":false},"created_at":"2015-02-23T16:58:29Z","updated_at":"2015-02-23T16:58:29Z","body":"The [inspection](https://scrutinizer-ci.com/g/owncloud/core/inspections/0e815258-36cd-4c4a-b68b-fad9cf0d1330) completed: **3 new issues**"}}