kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge branch 'docs-fe-security' into 'master'

Browse source 
Add frontend security documentation

See merge request gitlab-org/gitlab-ce!17622
This commit is contained in:
Tim Zallmann 2018-03-13 13:34:48 +00:00
commit dfed7b4575
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
doc/development/new_fe_guide/development/security.md
View file

@ -1,3 +1,14 @@
# Security
> TODO: Add content
## Avoid inline scripts and styles
Inline scripts and styles should be avoided in almost all cases. In an effort to protect users from [XSS vulnerabilities](https://en.wikipedia.org/wiki/Cross-site_scripting), we will be disabling inline scripts using Content Security Policy.
## Including external resources
External fonts, CSS, and JavaScript should never be used with the exception of Google Analytics and Piwik - and only when the instance has enabled it. Assets should always be hosted and served locally from the GitLab instance. Embedded resources via `iframes` should never be used except in certain circumstances such as with ReCaptcha, which cannot be used without an `iframe`.
## Resources for security testing
- [Mozilla's HTTP Observatory CLI](https://github.com/mozilla/http-observatory-cli)
- [Qualys SSL Labs Server Test](https://www.ssllabs.com/ssltest/analyze.html)