feat: Expect-Staple and Expect-CT support #6417
Conversation
Generated by 🚫 danger |
alex-hofsteede
force-pushed
the
alex/hpkp
branch
from
0879f37 to
7d75a94
Compare
mattrobenolt
left a comment
mattrobenolt
left a comment
There was a problem hiding this comment.
This is a big change, so just letting you know I'm looking at it and will get back to you. :)
|
@alex-hofsteede any chance of doing Expect-Staple at the same time? |
|
Yeah, Expct-Staple is next on the list. |
alex-hofsteede
force-pushed
the
alex/hpkp
branch
3 times, most recently
from
fe3d870 to
466eb47
Compare
alex-hofsteede
changed the title
alex-hofsteede
force-pushed
the
alex/hpkp
branch
2 times, most recently
from
5f18331 to
8f0e310
Compare
alex-hofsteede
force-pushed
the
alex/hpkp
branch
2 times, most recently
from
fe9aaa5 to
0616ab7
Compare
mattrobenolt
left a comment
mattrobenolt
left a comment
There was a problem hiding this comment.
All of this looks fine. The only missing piece is the UI to display these.
Would really like to address the urls though before approving. But code seems good otherwise..
alex-hofsteede
force-pushed
the
alex/hpkp
branch
from
0616ab7 to
0f58d86
Compare
|
@mattrobenolt so this can go out? |
In preparation for accepting other types of browser security reports, start using JSON schema to validate the structure of these documents to avoid duplicating a bunch of manual validation for the different report types.
Refactored the CSP endpoint and helpers to allow for support of HPKP violation reports. Added schema validation and filtering logic to make it easier to add more interfaces in future. Each can be checked against its own schema.
Adds an endpoint and schema for Expect-CT reports to be ingested.
Schemas, Interface class, and simple test.
Determine which type of security report is being sent from the report body
alex-hofsteede
force-pushed
the
alex/hpkp
branch
from
4476854 to
319f86b
Compare
mattrobenolt
left a comment
mattrobenolt
left a comment
There was a problem hiding this comment.
🎉 looks great, let's make sure we coordinate a change for the new endpoint with ops.
cc @JTCunning
We'll need a location block for /api/<project>/security/ that's identical to the current /api/<project>/csp-report/
( this can happen after this gets shipped since it's not really used yet )
|
I'm a bit late to the party (sorry) but it looks like the expect-staple header isn't something that's implemented by UAs and may never ship? See https://twitter.com/estark37/status/949336829349707776 for information (and a note on the preload version of expect-staple) |
Refactored the CSP endpoint and helpers to allow for support of HPKP violation reports. Added schema validation and filtering logic to make it easier to add more interface schemas in future.
Requires some more tests.