AppScan安全掃描：常見header頭安全問題處理

1、nginx配置添加一下代碼：

add_header X-Frame-Options 'SAMEORIGIN'; # 只允許本站用 frame 來嵌套
add_header X-XSS-Protection '1; mode=block'; # XSS 保護
add_header X-Content-Type-Options 'nosniff';#響應頭可以禁用瀏覽器的類型猜測行爲
add_header Strict-Transport-Security 'max-age=63072000;includeSubDomains';
 
配置如下：
location /cas/ {
			proxy_set_header Host $host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header REMOTE-HOST $remote_addr;
			add_header X-Frame-Options 'SAMEORIGIN'; # 只允許本站用 frame 來嵌套
			add_header X-XSS-Protection '1; mode=block'; # XSS 保護
			add_header X-Content-Type-Options 'nosniff';#響應頭可以禁用瀏覽器的類型猜測行爲
			add_header Strict-Transport-Security 'max-age=63072000;includeSubDomains';
			proxy_pass http://serVer/cas/;
			proxy_redirect default;
		}

2、jsp中java代碼

//<!-- 缺少跨幀腳本編制防禦 X-Frame-Options -->
					response.setHeader("X-Frame-Options", "DENY");
					//<!-- 缺少“Content-Security-Policy”頭 -->
					response.setHeader("Content-Security-Policy", "child-src http: https:");
					//<!-- 缺少 HTTP Strict-Transport-Security 頭 -->
					response.setHeader("Strict-Transport-Security", "max-age=31536000;includeSubDomains");
					//<!-- 缺少“X-Content-Type-Options”頭 -->
					response.setHeader("X-Content-Type-Options", "nosniff");
					response.setHeader("X-XSS-Protection", "1; mode=block");
					//<!-- 發現可高速緩存的 SSL -->
					response.setHeader("Cache-Control", "no-store");
					response.setHeader("Pragma", "no-cache");
					response.setDateHeader("Expires", 0);

3、jsp、html前端代碼

<!-- 缺少跨幀腳本編制防禦 X-Frame-Options
<meta http-equiv="X-Frame-Options" content="DENY" />
 -->
<!-- 缺少“Content-Security-Policy”頭 -->
<meta http-equiv="Content-Security-Policy" content="child-src http: https:" />
<!-- 缺少 HTTP Strict-Transport-Security 頭 -->
<meta http-equiv="Strict-Transport-Security" content="max-age=31536000;includeSubDomains" />
<!-- 缺少“X-Content-Type-Options”頭 -->
<meta http-equiv="X-Content-Type-Options" content="nosniff" />
<!-- 缺少“X-XSS-Protection”頭 -->
<meta http-equiv="X-XSS-Protection" content="1; mode=block" />
<!-- 發現可高速緩存的 SSL -->
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Cache-Control" content="no-store" />
<meta http-equiv="Expires" content="0" />