2

I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use?

Header unset Connection
Header unset Time-Zone
Header unset Keep-Alive
Header unset Access-Control-Allow-Origin
Header unset Access-Control-Allow-Headers
Header unset Access-Control-Expose-Headers
Header unset Access-Control-Allow-Methods
Header unset Access-Control-Allow-Credentials

Header set   Connection                         keep-alive
Header set   Time-Zone                          "Asia/Jerusalem"
Header set   Keep-Alive                         timeout=100,max=500
Header set   Access-Control-Allow-Origin        "*"
Header set   Access-Control-Allow-Headers     "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Param$
Header set   Access-Control-Expose-Headers    "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Param$
Header set   Access-Control-Allow-Methods     "CONNECT, DEBUG, DELETE, DONE, GET, HEAD, HTTP, HTTP/0.9, HTTP/1.0, HTTP/1.1, HTTP/2, OPTIONS, ORIGIN, ORIGINS, PATCH, POST, PUT$
Header set   Access-Control-Allow-Credentials   "true"

Header set DNT "0"
Header set Accept-Ranges "bytes"
Header set Vary "Accept-Encoding"
Header set X-UA-Compatible "IE=edge,chrome=1"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set X-Xss-Protection "1; mode=block"

closed as unclear what you're asking by Anders, Dog eat cat world, Purefan, Neil Smithline, LvB Jun 13 '16 at 8:06

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What do you mean by "allowed all headers"? Im not sure I understand. Are you talking about the value of Access-Control-Allow-Headers? Or about the Access-Control-Allow-* in general? – Anders Jun 10 '16 at 23:17
4

For testing and developing I allowed all Headers. ...

It is not very clear what you mean here (maybe be more specific and do not only dump the config) but...

 Header set   Access-Control-Allow-Origin        "*"
 Header set   Access-Control-Allow-Credentials   "true"

It is definitely not a good idea to allow cross origin access from everywhere. And it is even worse to combine this with sending cookies and other credentials.

With this loose restrictions an attacker could use XHR requests do access a site with the stored credentials of the user (i.e. session cookie), change data with permissions of the user (classical CSRF) and even read the response back (what classical CSRF can not do). For instance if you would deploy this code for a company internal application an outside attacker could use the internal users browser as a trampoline to fully access the application and read the content and all with the identity of the currently logged in user.

Such XHR based attacks could be delivered when the user visits the attackers site and such a visit could just be triggered from within an advertisement delivered by any of the ad networks.

Apart from that:

Header set   Access-Control-Allow-Methods     "...HEAD, HTTP, HTTP/0.9, HTTP/1.0, HTTP/1.1, HTTP/2, OPTIONS, ORIGIN, ...

I have no idea what you are trying to do here but methods are GET, POST, HEAD... and not HTTP/0.9, HTTP/1.0 etc. I really recommend that you take a closer look at how CORS works, what the headers mean and what the security implications are.

Not the answer you're looking for? Browse other questions tagged or ask your own question.