4516-nginx-browserSecurity - Suggest Adding Browser Security Headers¶

Rule ID¶

• 4516-nginx-browserSecurity

Category¶

• nginx

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• The X-Frame-Options header should be set to allow only specific websites or no website at all to embed your site as an object, depending on your organization's policy and application requirements.

• The X-Content-Type-Options header should be used to enforce supported user agents to check the Content-Type header of the HTTP response and the expected content type from the request target.

• The X-XSS-Protection header allows you to leverage browser-based protection against cross-site scripting. This should be implemented on your web server to protect users and increase user trust in your site. Your policy should be set to block mode where possible to ensure that the browser blocks the page when cross-site scripting is detected.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Setting X-Frame-Options, X-Content-Type-Options, and X-XSS-Protection helps secure your website. Modify them according to your actual application requirements!

Risk Items¶

• nginx security

Audit Method¶

• To verify the current settings of X-Frame-Options, X-Content-Type-Options, and X-XSS-Protection headers:

grep -ir X-Xss-Protection /etc/nginx
# The output should include
add_header X-Xss-Protection "1; mode=block";

grep -ir X-Content-Type-Options /etc/nginx
# The output should include
add_header X-Content-Type-Options "nosniff";

grep -ir X-Frame-Options /etc/nginx
# The output should include
add_header X-Frame-Options "SAMEORIGIN";

Remediation¶

• Locate the HTTP or server block in the nginx configuration. Add the headers according to your specific application and web system requirements:

 # Reduce clickjacking
add_header X-Frame-Options DENY;
# Prevent server from automatically parsing resource types
add_header X-Content-Type-Options nosniff;
# Protect against XSS attacks
add_header X-XSS-Protection "1; mode=block";

Impact¶

• If the browser security headers are not configured or are incorrectly configured, the website may be vulnerable to intrusion and attacks.

Default Value¶

• Not set by default.

References¶

• None

CIS Controls¶

• None