{"action":"created","issue":{"url":"https://api.github.com/repos/gogits/gogs/issues/552","repository_url":"https://api.github.com/repos/gogits/gogs","labels_url":"https://api.github.com/repos/gogits/gogs/issues/552/labels{/name}","comments_url":"https://api.github.com/repos/gogits/gogs/issues/552/comments","events_url":"https://api.github.com/repos/gogits/gogs/issues/552/events","html_url":"https://github.com/gogits/gogs/issues/552","id":45565327,"number":552,"title":"HTTP Security Headers","user":{"login":"sts","id":204585,"avatar_url":"https://avatars.githubusercontent.com/u/204585?v=3","gravatar_id":"","url":"https://api.github.com/users/sts","html_url":"https://github.com/sts","followers_url":"https://api.github.com/users/sts/followers","following_url":"https://api.github.com/users/sts/following{/other_user}","gists_url":"https://api.github.com/users/sts/gists{/gist_id}","starred_url":"https://api.github.com/users/sts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sts/subscriptions","organizations_url":"https://api.github.com/users/sts/orgs","repos_url":"https://api.github.com/users/sts/repos","events_url":"https://api.github.com/users/sts/events{/privacy}","received_events_url":"https://api.github.com/users/sts/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/gogits/gogs/labels/help%20wanted","name":"help wanted","color":"009800"},{"url":"https://api.github.com/repos/gogits/gogs/labels/kind/security","name":"kind/security","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2014-10-11T23:44:00Z","updated_at":"2016-02-23T22:28:34Z","closed_at":null,"body":"Enable various security extensions to prevent common attacks such as - list taken from [OWASP.org](https://www.owasp.org/index.php/List_of_useful_HTTP_headers)\r\n\r\n* Strict-Transport-Security:max-age=31536000; includeSubdomains; preload - enforces secure connections to the server.\r\n* X-Frame-Options:deny - provides clickjacking protection.\r\n* X-XSS-Protection:1; mode=block - enables the Cross-site scripting (XSS) filter built into most recent web browsers.\r\n* Content-Security-Policy\r\n\r\nThere might be configuration options needed. Also the session cookie should be set to [HttpOnly](https://www.owasp.org/index.php/HttpOnly).\r\n\r\nAlso including maxcdn resources into the codebase, would reduce the possibility that external parties are able to track users from using the application."},"comment":{"url":"https://api.github.com/repos/gogits/gogs/issues/comments/187943727","html_url":"https://github.com/gogits/gogs/issues/552#issuecomment-187943727","issue_url":"https://api.github.com/repos/gogits/gogs/issues/552","id":187943727,"user":{"login":"Unknwon","id":2946214,"avatar_url":"https://avatars.githubusercontent.com/u/2946214?v=3","gravatar_id":"","url":"https://api.github.com/users/Unknwon","html_url":"https://github.com/Unknwon","followers_url":"https://api.github.com/users/Unknwon/followers","following_url":"https://api.github.com/users/Unknwon/following{/other_user}","gists_url":"https://api.github.com/users/Unknwon/gists{/gist_id}","starred_url":"https://api.github.com/users/Unknwon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Unknwon/subscriptions","organizations_url":"https://api.github.com/users/Unknwon/orgs","repos_url":"https://api.github.com/users/Unknwon/repos","events_url":"https://api.github.com/users/Unknwon/events{/privacy}","received_events_url":"https://api.github.com/users/Unknwon/received_events","type":"User","site_admin":false},"created_at":"2016-02-23T22:28:33Z","updated_at":"2016-02-23T22:28:33Z","body":"@Jonny007-MKD thanks for the comments.\r\n\r\nBut I still don't get what does the code you provide to do with security?"}}