settings in git:

system specific configs are not very often in use. Those are useful if some binary that git is dependent is missing.

Global config is for most of your preferences

local config - for one-off special case changes.

Reading: git config --global user.name

Setting: git config --global user.name "User Name"

settings written to ~/.gitconfig

List all configs: git config --list

verbose: git config --list --show-origin

more verbose: git config --list --show-origin --show-scope

Unset: git config --local --unset user.name

.gitattributes

*.js text

*.ps1 eol=crlf

*.sh eol=lf

Filters in fit allow you to securely store secret data in git when pushing and restore it when data is pulled.

HTTP Strict Transport Security (HSTS) - web browsers are instructed to exclusively connect to a website over HTTPS - prevent from ManInTheMiddle

Syntax of HSTS:

To implement HSTS, the header is added to the website's HTTP response, specifying the maximum age, includeSubDomains directive, and preload directive, if applicable. The syntax typically follows this structure:

Strict-Transport-Security: max-age=<expire-time>; includeSubDomains; preload

max-age: Defines the duration for which the browser should cache the HSTS policy.

includeSubDomains: Optional directive that extends HSTS protection to all subdomains of the main domain.

preload: Optional directive that allows websites to be included in the HSTS preload list maintained by browsers for added security.

Example terraform code:

rewrite_rule {
      name = local.rewrite_rule_name_hsts
      rule_sequence = 20

      response_header_configuration {
        header_name = "Strict-Transport-Security"
        header_value = "max-age=2592000; includeSubDomains"
      }
    }

The Content Security Policy (CSP) - Content Security Policy header is by far the most powerful security header, offering unmatched protection against a several security threats.

Protects from cross side scripting.

Syntax

Here is an example of the syntax for setting up the most basic and minimal CSP header:

Content-Security-Policy: default-src 'self';

This example sets a basic content security policy that allows only resources from the same origin ('self') to be loaded by default. Generally people do not implement it this way, usually they include multiple resources.

Additional directives can be included to define specific settings for different resource types, such as scripts, stylesheets, images, fonts, and media. Here is an example with multiple directives:

Content-Security-Policy: default-src 'self'; script-src 'self' https://example.com; style-src 'self' https://cdn.example.com;

In this example:

default-src 'self'; sets the default policy to allow resources from the same origin.
script-src 'self' https://example.com; allows scripts to be loaded from the same origin and from the 'https://example.com' domain.
style-src 'self' https://cdn.example.com; permits stylesheets from the same origin and from the 'https://cdn.example.com' domain.

Start with:

* script-src - defines where can we load scripts from

* form-action - defines where form can send data

* conned-src - defines where javascript can connect to and send data

Security headers do not conflict.

There is not significant performance hit.

You need to update CSP (Content Security Policy) if new scripts are being added.

Permissions Policy Header - this is least privilege in web browser. We are allowing access to device permissions that app needs.

example:

accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()

asd

RP - Referrer Policy - This is a privacy focused header that ensures you do not send which page your user was on to the next site they visit.

Example:

#https://scotthelme.co.uk/a-new-security-header-referrer-policy/

      response_header_configuration {
        header_name = "Referrer-Policy"
        header_value = "strict-origin-when-cross-origin"
      }

X Frame Options* (for backwards compatibility only, assuming you must support older browsers) - blocks framing of your site

example:

response_header_configuration {
        header_name = "X-Frame-Options"
        header_value = "SAMEORIGIN"
      }

Reference: https://import.cdn.thinkific.com/880250/qHQGPzQoSxyc0SeUuRym_Semgrep-security-headers-cheat-sheet.pdf

IT Related

Saturday, April 26, 2025

security scanner - draft

git config

Wednesday, April 23, 2025

security headers

Syntax