- Make session cookies only available via HTTP (prevent access from JavaScript)
- only log PHP errors instead of displaying them in production.
Displaying errors may give attackers hints how to exploit the application
Set HTTP headers:
X-Frame-Options: DENY
Prevent Clickjacking attacks, see: http://en.wikipedia.org/wiki/Clickjacking
X-Content-Type-Options: nosniff
Prevent code injection via mime type sniffing
Former-commit-id: 4ca925874c
extended switch for using BasicAuth for Windows Phone and DigestAuth e.g. when iPhone tries to connect. Now Baikal is more flexible to support iPhone and Windows Phone on the fly.
Former-commit-id: 5f76f3f50b
extended switch for using BasicAuth for Windows Phone and DigestAuth e.g. when iPhone tries to connect. Now Baikal is more flexible to support iPhone and Windows Phone on the fly.
Former-commit-id: 987e7ec5cd