starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Add HTTP security headers #2725

New Issue
Closed
opened 2025-12-29 18:21:25 +01:00 by adam · 5 comments
adam commented 2025-12-29 18:21:25 +01:00
Owner
Copy Link

Originally created by @bbock on GitHub (Jul 5, 2019).

Environment

  • Python version: 3.6.8
  • NetBox version: 2.6.1

Proposed Functionality

In Netbox, several modern HTTP security headers are missing.

As a result, e.g. in the tool Security Headers, Netbox only yields a grade "D". Potential security bugs (especially XSS) would be harder to exploit if they are set correctly.

Missing are (ordered from easy to hard to implement):

  • X-Content-Type-Options: Stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type.
  • X-XSS-Protection: Sets the configuration for the cross-site scripting filter built into most browsers.
  • Referrer-Policy: Allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
  • Feature-Policy: Allows a site to control which features and APIs can be used in the browser.
  • Content Security Policy: An effective measure to protect the site from XSS attacks.

In the documentation, you recommend to add the X-Forwarded-Proto header. This allow Netbox to use additionally use relevant headers and options for HTTPS only:

  • Strict Transport Security for HTTPS (debatable whether this should be added by the proxy doing HTTPS termination, as this is typically not done in the application itself.)
  • The "secure" flag for cookies could be added.

Database Changes and External Dependencies

None are expected.

Documentation

Bonus Points:

The P3P policy included in the nginx example in the documentation is obsolete and should be removed.

Originally created by @bbock on GitHub (Jul 5, 2019). ### Environment * Python version: 3.6.8 * NetBox version: 2.6.1 ### Proposed Functionality In Netbox, several modern HTTP security headers are missing. As a result, e.g. in the tool [Security Headers](https://securityheaders.com/), Netbox only yields a grade "D". Potential security bugs (especially XSS) would be harder to exploit if they are set correctly. Missing are (ordered from easy to hard to implement): - [X-Content-Type-Options](https://scotthelme.co.uk/hardening-your-http-response-headers/#x-content-type-options): Stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. - [X-XSS-Protection](https://scotthelme.co.uk/hardening-your-http-response-headers/#x-xss-protection): Sets the configuration for the cross-site scripting filter built into most browsers. - [Referrer-Policy](https://scotthelme.co.uk/a-new-security-header-referrer-policy/): Allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. - [Feature-Policy](https://scotthelme.co.uk/a-new-security-header-feature-policy/): Allows a site to control which features and APIs can be used in the browser. - [Content Security Policy](https://scotthelme.co.uk/content-security-policy-an-introduction/): An effective measure to protect the site from XSS attacks. In the documentation, you recommend to add the `X-Forwarded-Proto` header. This allow Netbox to use additionally use relevant headers and options for HTTPS only: - [Strict Transport Security](https://scotthelme.co.uk/hsts-the-missing-link-in-tls/) for HTTPS (debatable whether this should be added by the proxy doing HTTPS termination, as this is typically not done in the application itself.) - The "secure" flag for cookies could be added. ### Database Changes and External Dependencies None are expected. ### Documentation Bonus Points: The [P3P policy included in the nginx example](https://netbox.readthedocs.io/en/stable/installation/3-http-daemon/#option-a-nginx) in the documentation [is obsolete](https://www.w3.org/TR/P3P11/) and should be removed.
adam added the type: documentationstatus: needs owner labels 2025-12-29 18:21:25 +01:00
adam closed this issue 2025-12-29 18:21:26 +01:00
adam commented 2025-12-29 18:21:26 +01:00
Author
Owner
Copy Link

@bellwood commented on GitHub (Nov 1, 2019):

Just having gone through securityheaders.com for clients I can say that some of this is beyond the scope of Netbox and more tailored to server security and "best practices" and can largely be per-installation.

To what depth one wants to go will largely be determined by company policy and the level of exposure your Netbox installation has to the public at large. Changes to anything inline or external with the source code (fonts, styles, scripts, etc) would have to be considered by anyone rolling these headers and make updates as needed.

As these things evolve, a maintainer will have to keep up with it and as @jeremystretch has stated, there is enough work already not getting done on the core let alone things that are loosely associated.

Not to say we cannot document this, just, perhaps we make a footnote to "Test and secure your installation via securityheaders.com" and let individual admins make those choices as they see fit?

@bellwood commented on GitHub (Nov 1, 2019): Just having gone through securityheaders.com for clients I can say that some of this is beyond the scope of Netbox and more tailored to server security and "best practices" and can largely be per-installation. To what depth one wants to go will largely be determined by company policy and the level of exposure your Netbox installation has to the public at large. Changes to anything inline or external with the source code (fonts, styles, scripts, etc) would have to be considered by anyone rolling these headers and make updates as needed. As these things evolve, a maintainer will have to keep up with it and as @jeremystretch has stated, there is enough work already not getting done on the core let alone things that are loosely associated. Not to say we cannot document this, just, perhaps we make a footnote to "Test and secure your installation via securityheaders.com" and let individual admins make those choices as they see fit?
adam commented 2025-12-29 18:21:27 +01:00
Author
Owner
Copy Link

@kobayashi commented on GitHub (Nov 2, 2019):

Hi @bbock,

Thank you for interesting netbox.
For the security headers, I would like to know about which site do you mention. If that is official docs, It's better to ask about the issue to readthedocs which provides documentation hosting service to many open source docs.

For P3P policy described as bonus point, thanks to let us know. Are you interested in updating the part?

@kobayashi commented on GitHub (Nov 2, 2019): Hi @bbock, Thank you for interesting netbox. For the security headers, I would like to know about which site do you mention. If that is [official docs](https://netbox.readthedocs.io/), It's better to ask about the issue to [readthedocs](https://docs.readthedocs.io/en/stable/security.html) which provides documentation hosting service to many open source docs. For P3P policy described as bonus point, thanks to let us know. Are you interested in updating the part?
adam commented 2025-12-29 18:21:27 +01:00
Author
Owner
Copy Link

@bbock commented on GitHub (Nov 8, 2019):

@kobayashi I'm not talking about the docs site, but netbox itself.

While many of the headers could be added in a proxy (probably everything except the cookie flag), I believe that netbox would benefit by a secure-by-default setup.

I created a trivial pull request to remove the P3P header from the docs (#3684), but cannot currently put more time into this at the moment.

@bbock commented on GitHub (Nov 8, 2019): @kobayashi I'm not talking about the docs site, but netbox itself. While many of the headers could be added in a proxy (probably everything except the cookie flag), I believe that netbox would benefit by a secure-by-default setup. I created a trivial pull request to remove the P3P header from the docs (#3684), but cannot currently put more time into this at the moment.
adam commented 2025-12-29 18:21:27 +01:00
Author
Owner
Copy Link

@kobayashi commented on GitHub (Nov 8, 2019):

Thank you for taking your time.
The security header depends on each user though, it is helpful to see samples in the docs.
I will see your PR later.
Just make sure if ok to close after merge it? Or I will keep this if you want to add more. @bbock

@kobayashi commented on GitHub (Nov 8, 2019): Thank you for taking your time. The security header depends on each user though, it is helpful to see samples in the docs. I will see your PR later. Just make sure if ok to close after merge it? Or I will keep this if you want to add more. @bbock
adam commented 2025-12-29 18:21:28 +01:00
Author
Owner
Copy Link

@kobayashi commented on GitHub (Nov 12, 2019):

Close by #3684

@kobayashi commented on GitHub (Nov 12, 2019): Close by #3684
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: needs owner type: documentation
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#2725
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?