Categories
IT-Stuff

CSP WordPress

still painfull but in the end its not working well

Content-Security-Policy HTTP response header helps to reduce XSS risks on modern browsers by declaring, which dynamic resources they are allowed to load.
The Content-Security-Policy header allows to restrict how resources such as JavaScript, CSS, or pretty much anything that the browser loads.

What types of attacks does Content-Security-Policy help reduce?
Content-Security-Policy was first designed to reduce the attack surface of Cross Site Scripting (XSS) attacks and further on also to protect against other forms of attack such as Click Jacking.

Referring to Recital 83 GDPR, Security of Processing GDPR, when you touch personal data processing there is no way out of
trying everything to set security up to state of the art. Of Course always taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the personal data to be protected.
Always have a look at GDPR Art5.1.f, Art25, Art32.2 too.

So a guess out in the wild, WordPress will still be used and serving content with script-src ‘unsafe-inline’ and ‘unsafe-eval’ till someone is gonna fix this without breaking that whole CMS.

Categories
IT-Stuff

WordPress & CSP #GDPR #DSGVO

and yess if you read the ticket top down and have a look on the timestamps … yes its a pain in the ass

not to mention that there is something called #GDPR and something called state of the art

so as far as I’m concerned we can live with a B whatever rating because
there is no other way round without breaking the whole thing.

Link: https://core.trac.wordpress.org/ticket/39941

Categories
IT-Stuff

CSP / DSGVO / WordPress

a true pain in the ass Part II

Getting WP installation in line with #GDPR / #DSGVO is a real pain if you are not willing to accept a B or even a B+ on your ratings.

Why are we doing this?
somehow forced by #GDPR / #DSGVO Art5.1.f Art25 Art32.2

Setting up Content-Security-Policy as we should do to get along with #GDPR / #DSGVO will break your WP-Installation as far as what we seen here so far. The List of not working stuff, ist long, and yes I can tell you really long, from non workin PlugIns over corrupted Themes to a not working default Editor. Sumed Up … a pain in the ass

So what will it gonna be?
After not feeling the vibe for trial and error on this topic we call it a day with an unsafe impelmented CSP but a full working WP installation.




Categories
IT-Stuff

Quick Tip

WordPress / #GDPR / #DSGVO

?? a pain in the ass if not self hosted??

What we need to check and resolve to get it done:

  • HTTPS as a default (DSGVO Art25)
  • HTTP Strict Transport Security (HSTS)
  • Content Security Policy (CSP) ((DSGVO Art32.2)
    • !! this may/will break some of your plugins or everything !!
  • Referrer Policy (DSGVO Art5.1.c & 25 & 32.2)
  • Subresource Integrity (SRI) (DSGVO Art5.1.f & 25 & 32.2)
  • HTTP-Header (DSGVO Art5.1.c & Art5.1.f 25 & 32.1-2)
    • X-Content-Type Options
    • X-Frame Options
    • X-XSS-Protection
  • Cookies yes/no (DSGVO Art5.1.a c e & Art21 & 22 & 23)
  • First Party Request
  • Third Party Request (DSGVO Art5.1.b-c Art25)

We’ll keep u posted what comes next! oh yes there is still some more …