{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/thimble.mozilla.org/issues/1517","repository_url":"https://api.github.com/repos/mozilla/thimble.mozilla.org","labels_url":"https://api.github.com/repos/mozilla/thimble.mozilla.org/issues/1517/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/thimble.mozilla.org/issues/1517/comments","events_url":"https://api.github.com/repos/mozilla/thimble.mozilla.org/issues/1517/events","html_url":"https://github.com/mozilla/thimble.mozilla.org/issues/1517","id":166185830,"number":1517,"title":"Update server's security headers","user":{"login":"marumari","id":230528,"avatar_url":"https://avatars.githubusercontent.com/u/230528?v=3","gravatar_id":"","url":"https://api.github.com/users/marumari","html_url":"https://github.com/marumari","followers_url":"https://api.github.com/users/marumari/followers","following_url":"https://api.github.com/users/marumari/following{/other_user}","gists_url":"https://api.github.com/users/marumari/gists{/gist_id}","starred_url":"https://api.github.com/users/marumari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marumari/subscriptions","organizations_url":"https://api.github.com/users/marumari/orgs","repos_url":"https://api.github.com/users/marumari/repos","events_url":"https://api.github.com/users/marumari/events{/privacy}","received_events_url":"https://api.github.com/users/marumari/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-07-18T20:29:21Z","updated_at":"2016-07-19T15:32:19Z","closed_at":null,"body":"Hey there!  April here from the Mozilla infosec team.  Just wanted to help you out a little bit, getting your server's headers inline with our security guidelines.  :)\r\n\r\n> X-Frame-Options: ALLOW-FROM https://pontoon.mozilla.org\r\n\r\nALLOW-FROM is only supported by Firefox, and has been deprecated in place of this:\r\n\r\n> Content-Security-Policy: frame-ancestors https://pontoon.mozilla.org\r\n\r\nThis works in Firefox, Chrome, and Safari and hopefully Edge someday.  To protect users of older browser from possible clickjackings, I would set it like this:\r\n\r\nContent-Security-Policy: frame-ancestors https://pontoon.mozilla.org\r\nX-Frame-Options: DENY\r\n\r\n> Strict-Transport-Security: max-age=86400\r\n\r\nPlease set this to a year:\r\n\r\n> Strict-Transport-Security: max-age=31536000\r\n\r\nI see you're well on your way to getting CSP implemented, with Content-Security-Policy-Report-Only, which is absolutely fantastic.  Thanks so much!"},"comment":{"url":"https://api.github.com/repos/mozilla/thimble.mozilla.org/issues/comments/233671094","html_url":"https://github.com/mozilla/thimble.mozilla.org/issues/1517#issuecomment-233671094","issue_url":"https://api.github.com/repos/mozilla/thimble.mozilla.org/issues/1517","id":233671094,"user":{"login":"gideonthomas","id":5816130,"avatar_url":"https://avatars.githubusercontent.com/u/5816130?v=3","gravatar_id":"","url":"https://api.github.com/users/gideonthomas","html_url":"https://github.com/gideonthomas","followers_url":"https://api.github.com/users/gideonthomas/followers","following_url":"https://api.github.com/users/gideonthomas/following{/other_user}","gists_url":"https://api.github.com/users/gideonthomas/gists{/gist_id}","starred_url":"https://api.github.com/users/gideonthomas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gideonthomas/subscriptions","organizations_url":"https://api.github.com/users/gideonthomas/orgs","repos_url":"https://api.github.com/users/gideonthomas/repos","events_url":"https://api.github.com/users/gideonthomas/events{/privacy}","received_events_url":"https://api.github.com/users/gideonthomas/received_events","type":"User","site_admin":false},"created_at":"2016-07-19T15:32:19Z","updated_at":"2016-07-19T15:32:19Z","body":"@cadecairos nope no reason at all. I think it was done earlier during the dev process, when we didn't have time to fix CSP errors."}}
{"actor":{"display_login":"gideonthomas"}}