This article is the third part in our three-part series on security.
Read the first part about a threat model and read about email spoofing, trusted sources and cross-site scripting in part 2.
Frames
Iframes can be used to load a page directly inside another page. You will often come across this on our websites when a video from Vimeo needs to be loaded. For most websites, though, there is no need at all for the website to be loadable in an iframe. This only creates a security risk, in which a malicious website can load your site and, for example, intercept clicks or generate advertising revenue using your content.
To prevent this, you can use the X-Frame-Options header to tell browsers whether or not your website may be shown in an iframe.
Secure connection
Google has for some time now been ranking websites that are primarily accessible via a secure connection higher than websites that do not implement this. But why, actually?
When you visit a website, you send a request to a web server, which sends a response back to you. In the same way, you send data in a form, for example, or retrieve images. How this data is transmitted is described in the http protocol that browsers use. This protocol, however, has the drawback that the data can be read and altered between your computer and the web server by someone with malicious intent. This is called a “man-in-the-middle attack” (MitM).
A secure connection protects against this kind of attack in most cases. With an https connection, data is encrypted and decrypted using a key so that only the web server and your browser can read the data.
To carry out a MitM attack anyway, there are two options. The attacker forces the unsecured http connection and makes sure no https connection is established, or the attacker sets up an https connection between the attacker’s computer and your browser.
A simple permanent redirect from http to https is the minimum needed to have visitors reach your site over secure connections. To make sure a website is always loaded over https, there is also the Strict-Transport-Security header (HSTS). When the browser receives this header in a response from the server, the site is then always loaded over https afterwards, without the browser first sending a request for data over http. This header can even indicate that the site should be added to a “preload” list, so that even browsers that have never visited a website before always load the website over https.
Certificates used to secure the connection over https are issued for a specific domain, or set of domains. Before issuing a certificate, the authority that issues it checks whether the party requesting the certificate also has control over the domain. A MitM attack in which the attacker sets up their own https connection as if it comes from your website is therefore almost impossible without you knowing. In practice, it is used on the networks of large companies, where the IT department installs a trusted certificate on employees’ computers, allowing it to view data sent or received on the company’s network. In July 2019, the government of Kazakhstan implemented something similar, requiring residents of the country to install a so-called root certificate on their computer. This allows that government to read, store and manipulate all internet traffic between its residents and websites. Besides invalidating root certificates that make such attacks possible, public key pinning can also be used to reduce the risk of such an attack. This explicitly links a website to a specific certificate.
Has your organisation changed recently? Does your threat model still match reality? Get in touch, no obligation, to see what we can do for you.
Written by our Full Stack developer: Dico