Two Headers That Cost Nothing and Close Two Real Holes
Two headers now go out with every page of every customer site.
nosniff stops a browser from guessing that a response is a web page when the declared type says it is an image. That guess is exactly how a file that lies about what it is ends up running on the customer's own domain, which matters on a platform that accepts uploads from anybody.
SAMEORIGIN stops another website loading a customer's page invisibly inside its own interface and collecting clicks meant for something else. It was checked first that nothing here does that legitimately: every embedded frame in this codebase is a video sitting inside a customer page, and the header does not affect those.
Both are set on error responses too, which now includes the 404s added when unknown addresses stopped answering 200.
Two that are deliberately absent
These are worth stating, because a security writeup that lists only what was added is a sales pitch.
A content security policy is the obvious next one, and here it would be close to decorative. These pages carry 11 inline scripts, 8 style blocks and 18 inline style attributes, so any workable policy would have to permit inline code for both, which is most of what such a policy exists to prevent.
Doing it properly means threading per-request tokens through 97 purchased designs. That is a project, not a header. And a policy that permits everything is worse than no policy, because it appears on a scan as protection that is not there.
Strict transport security is a commitment rather than a setting. Once a browser has cached the instruction, the host cannot serve an unencrypted page for its whole lifetime, no matter what has gone wrong.
A certificate renewal that fails would turn a warning a visitor can click past into a hard block, across 46 customer-owned domains at once. It is worth doing, deliberately, with a short lifetime and without the aggressive options. Not as a line added in passing.
One favicon instead of an icon set per site
Related, and smaller. Each site carried its own arrangement of icon files, and none of them was the current mark.
They point at a single square vector file now, rasterized on demand at whatever size is asked for. So changing the mark is one file rather than an icon set to re-cut and redeploy per site.
Delivered as PNG specifically rather than as whatever format is most efficient, because a favicon served in a modern format is a coin toss across browsers, and iOS wants a real PNG for the home screen icon. This is one of the few places where the efficient answer is the wrong one.
Related
Keeping your actor website secure, connecting your own domain, and per-page titles and descriptions, which is where those 404s came from.
Nothing here needs anything from you. Create a free actor website.
