网站安全响应头缺失和php配置漏洞
PHP 设置方法header(X-Frame-Options:SAMEORIGIN;);// X-Frame-Options 响应头缺失 header(Referrer-Policy:origin;);//Referer-Policy 响应头缺失 header(Content-Security-Policy:frame-ancestors self;);//Content-Security-Policy 响应头缺失 header(X-Permitted-Cross-Domain-Policies:master-only;);//X-Permitted-Cross-Domain-Policies 响应头缺失 header(X-XSS-Protection:1; modeblock;);//X-XSS-Protection 响应头缺失 header(X-Download-Options: SAMEORIGIN;);//X-Download-Options 响应头缺失 header(X-Content-Type-Options:nosniff;);//X-Content-Type-Options 响应头缺失 header(Strict-Transport-Security:max-age31536000;);//Strict-Transport-Security 响应头缺失Nginx配置方法add_header Strict-Transport-Securitymax-age31536000;add_header X-Frame-Options SAMEORIGIN always;add_header Content-Security-Policyframe-ancestors selfalways;add_header X-XSS-Protection1; modeblock;;add_header X-Download-Options SAMEORIGIN;add_header X-Content-Type-Options nosniff always;#add_header Referrer-Policy origin;add_header Referrer-Policystrict-origin-when-cross-originalways;#add_header X-Permitted-Cross-Domain-Policies master-only;add_header X-Permitted-Cross-Domain-Policiesnonealways;#add_header Set-Cookie HttpOnly;#add_header Set-Cookie Secure;缺少HTTPOnly和Secure属性解决方案php.ini 文件开启以下两行默认大概位于1390左右session.cookie_httponlytrue session.cookie_secure或者在 php 代码中使用 ini_set 函数设置 ini_set(session.cookie_httponly,On);ini_set(session.cookie_secure,On);ini_set(session.use_only_cookies,On);
