{"action":"created","issue":{"url":"https://api.github.com/repos/mholt/caddy/issues/312","repository_url":"https://api.github.com/repos/mholt/caddy","labels_url":"https://api.github.com/repos/mholt/caddy/issues/312/labels{/name}","comments_url":"https://api.github.com/repos/mholt/caddy/issues/312/comments","events_url":"https://api.github.com/repos/mholt/caddy/issues/312/events","html_url":"https://github.com/mholt/caddy/issues/312","id":115150186,"number":312,"title":"[idea] 'secure' directive","user":{"login":"coolaj86","id":122831,"avatar_url":"https://avatars.githubusercontent.com/u/122831?v=3","gravatar_id":"","url":"https://api.github.com/users/coolaj86","html_url":"https://github.com/coolaj86","followers_url":"https://api.github.com/users/coolaj86/followers","following_url":"https://api.github.com/users/coolaj86/following{/other_user}","gists_url":"https://api.github.com/users/coolaj86/gists{/gist_id}","starred_url":"https://api.github.com/users/coolaj86/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coolaj86/subscriptions","organizations_url":"https://api.github.com/users/coolaj86/orgs","repos_url":"https://api.github.com/users/coolaj86/repos","events_url":"https://api.github.com/users/coolaj86/events{/privacy}","received_events_url":"https://api.github.com/users/coolaj86/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mholt/caddy/labels/feature%20request","name":"feature request","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-04T21:19:11Z","updated_at":"2016-03-31T03:00:52Z","closed_at":null,"body":"Just an idea for discussion for now:\r\n\r\nI'm not sure on exactly what this should look, but I'd like to see a `secure` directive that turns on reasonable-default headers for CSP, iframe blocking, block POSTs from hitting the backend unless CORS is actually enabled, https keypinning, etc, etc, etc.\r\n\r\nObviously there are a million things that could be heavily configured, but for people that actually know what they're doing they could simply turn off the feature that offends them and handle it in their own application layer.\r\n\r\n```\r\n# turn it all on\r\nsecure\r\n```\r\n\r\n```\r\nsecure {\r\n  iframe-block off\r\n  csp-img-src off\r\n}\r\n```\r\n\r\nNote that turning off CSP for images would not actually remove it from the header, but instead modify the header to include `https://`, `blob:`, and `data:`.\r\n\r\nJust make it easier for people who don't understand web security to get the minimal protection.\r\n"},"comment":{"url":"https://api.github.com/repos/mholt/caddy/issues/comments/203727625","html_url":"https://github.com/mholt/caddy/issues/312#issuecomment-203727625","issue_url":"https://api.github.com/repos/mholt/caddy/issues/312","id":203727625,"user":{"login":"netaisllc","id":1242423,"avatar_url":"https://avatars.githubusercontent.com/u/1242423?v=3","gravatar_id":"","url":"https://api.github.com/users/netaisllc","html_url":"https://github.com/netaisllc","followers_url":"https://api.github.com/users/netaisllc/followers","following_url":"https://api.github.com/users/netaisllc/following{/other_user}","gists_url":"https://api.github.com/users/netaisllc/gists{/gist_id}","starred_url":"https://api.github.com/users/netaisllc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/netaisllc/subscriptions","organizations_url":"https://api.github.com/users/netaisllc/orgs","repos_url":"https://api.github.com/users/netaisllc/repos","events_url":"https://api.github.com/users/netaisllc/events{/privacy}","received_events_url":"https://api.github.com/users/netaisllc/received_events","type":"User","site_admin":false},"created_at":"2016-03-31T03:00:52Z","updated_at":"2016-03-31T03:00:52Z","body":"FYI, **Negroni** is the successor to Martini, same \"security start kit\" idea there, using this Go http middleware:  \r\n https://github.com/unrolled/secure"}}