{"id":1056,"date":"2024-07-03T09:46:35","date_gmt":"2024-07-03T01:46:35","guid":{"rendered":"https:\/\/blog.nonot.cn\/?p=1056"},"modified":"2024-07-08T12:40:35","modified_gmt":"2024-07-08T04:40:35","slug":"nginx%e5%ae%89%e5%85%a8%e5%8a%a0%e5%9b%ba%ef%bc%9aclear-site-datacontent-security-policypermissions-policystrict-transport-securityx-permitted-cross-domain-policiesx-frame-options%e5%93%8d","status":"publish","type":"post","link":"https:\/\/blog.nonot.cn\/index.php\/2024\/07\/03\/nginx%e5%ae%89%e5%85%a8%e5%8a%a0%e5%9b%ba%ef%bc%9aclear-site-datacontent-security-policypermissions-policystrict-transport-securityx-permitted-cross-domain-policiesx-frame-options%e5%93%8d\/","title":{"rendered":"nginx\u5b89\u5168\u52a0\u56fa\uff1aClear-Site-Data,Content-Security-Policy,Permissions-Policy,Strict-Transport-Security,X-Permitted-Cross-Domain-Policies,X-Frame-Options\u54cd\u5e94\u5934\u7f3a\u5931\u95ee\u9898"},"content":{"rendered":"

\u9879\u76ee\u88ab\u626b\u51fa\u4e86\u6f0f\u6d1e\uff0c\u9700\u8981\u5b89\u5168\u52a0\u56fa\uff0c\u770b\u4e86\u4e0b\u5927\u90e8\u5206\u90fd\u662f\u548c\u8bf7\u6c42\u5934\u76f8\u5173\u7684\uff0c\u7279\u5730\u8bb0\u5f55\u4e0b<\/p>\n

\u4ee5\u4e0b\u4e3anginx\u914d\u7f6e\u6587\u4ef6<\/p>\n

\n
\"copycode-1\"<\/a><\/span><\/div>\n
http{\r\n...\r\n    client_max_body_size 300M;\r\n\r\n    #\u5b89\u5168\u52a0\u56fa\r\n    keepalive_timeout 55;\r\n    client_body_timeout 10;\r\n    client_header_timeout 10;\r\n    send_timeout 10;\r\n    limit_conn ops 20;\r\n    limit_conn_zone $binary_remote_addr zone=ops:10m;\r\n    autoindex off;\r\n    dav_methods off;\r\n    server_tokens off;\r\n    client_body_buffer_size 1K;\r\n    client_header_buffer_size 1k;\r\n    large_client_header_buffers 2 1k;\r\n    add_header Content-Security-Policy  \"default-src 'self' https:\/\/a.cn:8822\/ https:\/\/b.cn\/ https:\/\/c.cn\/ https:\/\/d.cn:8553\/ 'unsafe-inline' 'unsafe-eval' blob: data:;\";\r\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";\r\n    add_header X-Permitted-Cross-Domain-Policies  \"master-only\";\r\n    add_header Referrer-Policy \"origin\";\r\n    add_header X-Download-Options \"noopen\" always;\r\n    #add_header Clear-Site-Data: \"*\";\r\n    add_header Clear-Site-Data \"storage\";\r\n    add_header Cross-Origin-Embedder-Policy require-corp;\r\n    add_header Cross-Origin-Opener-Policy same-site;\r\n    add_header Cross-Origin-Resource-Policy same-site;\r\n    add_header Permissions-Policy \"interest-cohort=()\";\r\n\r\n\r\n\r\n    #\u9632\u6b62XSS\u653b\u51fb\r\n    add_header X-Frame-Options \"SAMEORIGIN\";\r\n    add_header X-XSS-Protection \"1; mode=block\";\r\n    add_header X-Content-Type-Options \"nosniff\";\r\n\r\n\r\n\r\n\r\n    #\u914d\u7f6e\u91cd\u5b9a\u5411404\u9875\u9762\r\n    proxy_intercept_errors on;\r\n    error_page  404  https:\/\/X.X.X.X\/404;\r\n\r\n...\r\n   server{\r\n     ...\r\n      ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;\r\n      ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE:ECDH:AES:HIGH:EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:!NULL:!aNULL:!eNULL:!EXPORT:!PSK:!ADH:!DH:!DES:!MD5:!RC4;\r\n      ssl_prefer_server_ciphers on;\r\n\r\n      # ssl\u4f1a\u8bdd\u590d\u7528\u8d85\u65f6\u65f6\u95f4\u4ee5\u53ca\u4f1a\u8bdd\u590d\u7528\u7f13\u5b58\u5927\u5c0f\r\n      ssl_session_timeout 1d;\r\n      ssl_session_cache shared:MozSSL:10m; # about 40000 sessions\r\n\r\n    #\u5f3a\u5339\u914d\uff0c\u7981\u6b62\u8bbf\u95ee\u67d0\u4e2a\u9875\u9762\uff0c\u6bd4\u5982\u63a5\u53e3\u8c03\u7528\u8bf4\u660e\uff0c\u4e0d\u5f71\u54cd\u8be5\u5730\u5740\u540e\u9762\u52a0\u5176\u4ed6\u53c2\u6570\u7684\u8bbf\u95ee\r\n    if ($request_uri = \"\/api\/JBXQ_DLST\/\")\r\n    {\r\n     return 403;\r\n    }\r\n\r\n \r\n\r\n    #\u9632\u6b62\u6076\u610f\u57df\u540d\u89e3\u6790\u548c\u76d7\u94fe\r\n    if ( $host !~* 'a.cn' )\r\n    {\r\n    return 403;\r\n    }\r\n\r\n \r\n\r\n    #\u8bf7\u6c42\u65b9\u6cd5\u9650\u5236\r\n    if ($request_method !~ ^(GET|HEAD|POST)$ )\r\n    {\r\n    return 501;\r\n    }\r\n\r\n\r\n    #\u5c01\u6740\u5404\u79cduser-agent\r\n    if ($http_user_agent ~* \"java|python|perl|ruby|curl|bash|echo|uname|base64|decode|md5sum|select|concat|httprequest|httpclient|nmap|scan|nessus|wvs\" ) {\r\n    return 403;\r\n    }\r\n\r\n    #if ($http_user_agent ~* \"\" ) {\r\n    # return 403;\r\n    #}\r\n\r\n    #\u5c01\u6740\u7279\u5b9a\u7684\u6587\u4ef6\u6269\u5c55\u540d\u6bd4\u5982.bak\u4ee5\u53ca\u76ee\u5f55;\r\n    location ~* .(bak|swp|save|sh|sql|mdb|svn|git|old)$ {\r\n    rewrite ^\/(.*)$ $host permanent;\r\n    }\r\n    location \/(admin|phpadmin|status) { deny all; }\r\n\r\n     ...\r\n\r\n  }\r\n\r\n}<\/pre>\n
\"copycode-1\"<\/a><\/span><\/div>\n<\/div>\n
 <\/p>\n
\u8fd9\u91cc\u9762\u5176\u4ed6\u53c2\u6570\u90fd\u5f88\u597d\u914d\u7f6e\uff0c\u552f\u72ec\u00a0Content-Security-Policy\uff08CSP\uff09\u6709\u70b9\u96be\u914d\u7f6e\uff1a<\/p>\n
CSP\u7c7b\u4f3c\u4e8e\u4e00\u4e2a\u767d\u540d\u5355\uff0c\u544a\u8bc9\u6d4f\u89c8\u5668\u8fd0\u884c\u52a0\u8f7d\u54ea\u4e9b\u4e1c\u897f\uff0cnginx\u914d\u7f6e\u683c\u5f0f\u5982\u4e0b\uff1a<\/p>\n
\n
add_header Content-Security-Policy \"default-src 'self';script-src * 'unsafe-inline' 'unsafe-eval';...;\";<\/pre>\n<\/div>\n
\u8bf4\u660e\uff1a<\/p>\n
\uff081\uff09\u4e00\u4e2a\u7c7b\u578b\u7684\u89c4\u5219\u7528\uff1b\u5206\u9694<\/p>\n
\uff082\uff09\u5176\u4e2ddefault-src\u662f\u9ed8\u8ba4\u914d\u7f6e\uff0c\u4efb\u4f55\u672a\u914d\u7f6e\u7684\u89c4\u5219\u7c7b\u578b\u90fd\u4ee5\u8fd9\u4e2a\u4e3a\u51c6\uff0c\u914d\u7f6e\u7684\u65f6\u5019\u53ef\u4ee5\u6839\u636e\u68c0\u67e5\u63a7\u5236\u53f0\u91cc\u9762\u7684\u62a5\u9519\u9010\u4e2a\u6dfb\u52a0\u53c2\u6570<\/p>\n
\u5e38\u5e38\u770b\u6709\u7684\u4eba\u914d\u7f6e\u4e86default-src \u914d\u7f6e\u7684\u53c2\u6570\uff0c\u53e6\u4e00\u4e2a\u7c7b\u578b\u6bd4\u5982script-src\u53c8\u914d\u7f6e\u4e86\u4e00\u904d\u4e00\u6837\u7684\uff0c\u8fd9\u662f\u6ca1\u6709\u5fc5\u8981\u7684\uff0c\u6211\u6bd4\u8f83\u61d2\uff0c\u5c31\u914d\u7f6e\u4e86\u4e00\u4e2adefault-src\uff0c\u5982\u679c\u4e0d\u653e\u5fc3\u8fd8\u53ef\u4ee5\u6362\u6210Content-Security-Policy-Report-Only\u53c2\u6570\uff0c\u914d\u4e0areport-uri\u90ae\u4ef6\u5730\u5740\u63a5\u6536\u5f02\u5e38\u63d0\u9192<\/p>\n
\uff083\uff09\u89c4\u5219\u4e0d\u652f\u6301\u901a\u914d\u7b26* \uff1a\u5982\u679c\u914d\u7f6e\u7f51\u9875\u767d\u540d\u5355\u5e26\u7aef\u53e3\u7684\uff0c\u8981\u5e26\u4e0a\u7aef\u53e3\u53f7\uff0c\u5426\u5219\u8bc6\u522b\u4e0d\u4e86<\/p>\n
\u4f8b\u5982\uff1ahttps:\/\/a.cn:8822\/\uff0c\u5f53\u914d\u7f6ehttps:\/\/a.cn\u4f1a\u963b\u6321https:\/\/a.cn:8822\/\u7684\u8bbf\u95ee<\/p>\n
\uff084\uff09server\u6a21\u5757\u91cc\u9762\u7684add_header\u4f18\u5148\u7ea7\u9ad8\u4e8ehttp\u6a21\u5757\uff0c\u4f1a\u5168\u91cf\u66ff\u6362http\u6a21\u5757\u7684\u53c2\u6570\uff0c\u914d\u7f6e\u7684\u65f6\u5019\u8981\u6ce8\u610f\uff0c\u6211\u5c31\u9047\u5230\u4e86\u5728http\u6a21\u5757\u914d\u7f6e\u600e\u4e48\u4e5f\u4e0d\u751f\u6548\u7684\u5751<\/p>\n
\u53c2\u8003\u6587\u6863\uff1ahttps:\/\/blog.csdn.net\/Fly_hps\/article\/details\/86466367<\/a><\/p>\n
\u00a0https:\/\/blog.csdn.net\/dzqxwzoe\/article\/details\/128611368<\/a><\/p>\n
 <\/p>\n
 <\/p>\n
 <\/p>\n
\u53c2\u8003\u6587\u6863\uff1a<\/p>\n
https:\/\/developer.mozilla.org\/zh-CN\/docs\/Web\/HTTP\/Headers\/Clear-Site-Data<\/a><\/p>\n
https:\/\/www.cnblogs.com\/haiyoyo\/p\/17093874.html<\/a><\/p>\n
https:\/\/blog.csdn.net\/liwan09\/article\/details\/130248003<\/a><\/p>\n
https:\/\/blog.csdn.net\/masteryee\/article\/details\/83689954<\/a><\/p>\n
 <\/p>\n
https:\/\/blog.csdn.net\/jie1134514406\/article\/details\/124668625<\/a><\/p>\n
https:\/\/blog.csdn.net\/youyudexiaowangzi\/article\/details\/87713411<\/a><\/p>\n
https:\/\/www.cnblogs.com\/PeunZhang\/p\/15133251.html<\/a><\/p>\n
https:\/\/zhuanlan.zhihu.com\/p\/396062386<\/a><\/p>\n
 <\/p>\n
 <\/p>\n
 <\/p>\n
\u9047\u5230\u7684\u62a5\u9519\uff1a<\/p>\n
1.net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin 200 (OK)\u00a0 \/\u00a0 NotSameOriginAfterDefaultedToSameOriginByCoep<\/p>\n
\u573a\u666f\u4e3a\u6211\u4eec\u7684\u7ad9\u70b9A\uff1aa.cn:1001 \u8bbf\u95ee\u7ad9\u70b9B a.cn:1002\u51fa\u73b0\u7684\u62a5\u9519<\/p>\n
\n
      add_header Cross-Origin-Embedder-Policy require-corp;\r\n      add_header Cross-Origin-Opener-Policy same-origin;\r\n      add_header Cross-Origin-Resource-Policy same-origin;<\/pre>\n<\/div>\n
NotSameOrigin\u4e3a1002\u7684\u62a5\u9519\uff0cNotSameOriginAfterDefaultedToSameOriginByCoep\u4e3a1001\u7684\u62a5\u9519<\/p>\n
\u4e5f\u5c31\u662f\u8fd9\u4e2a\u89c4\u5219\u65e2\u9650\u5236\u88ab\u8bbf\u95ee\uff0c\u4e5f\u9650\u5236\u8bbf\u95ee<\/p>\n
\u89e3\u51b3\u65b9\u6cd5\u5c31\u662f\u4fee\u65391001\u548c1002\u7684\u914d\u7f6e\u5982\u4e0b\u5373\u53ef\uff1a<\/p>\n
\n
      add_header Cross-Origin-Embedder-Policy require-corp;\r\n      add_header Cross-Origin-Opener-Policy same-site;\r\n      add_header Cross-Origin-Resource-Policy same-site;<\/pre>\n<\/div>\n
\u53c2\u8003\u6587\u6863\uff1ahttps:\/\/blog.csdn.net\/qq_34754747\/article\/details\/115694691<\/a><\/p>\n
 <\/p>\n
\u6216\u8005\u5728\u4e0d\u6539\u53d8\u5b89\u5168\u7b56\u7565\u7684\u524d\u63d0\u4e0b\u52a0\u4e0b\u8de8\u57df\u767d\u540d\u5355\u4e5f\u662f\u53ef\u884c\u7684\uff0c\u6bd4\u5982\uff1a<\/p>\n
\u8bbf\u95ee\u7684\u9875\u9762\uff0c\u52a0\u8f7d\u963f\u91cc\u4e91\u56fe\u7247\u52a0\u8f7d\u4e0d\u51fa\u6765\uff0c\u62a5\u9519 net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep 200 (OK)<\/p>\n
\u53ef\u4ee5\u5728\u9875\u9762\u5bf9\u5e94\u7684 location \u6a21\u5757\u91cc\u52a0\u4e0a\u8de8\u57df\u767d\u540d\u5355\uff0c\u7ecf\u8fc7\u5b9e\u6d4b\u4e5f\u662f\u53ef\u884c\u7684<\/p>\n
\n
        #\u4f18\u5316\u5b89\u5168\u7b56\u7565\uff0c\u4f7f\u9875\u9762\u53ef\u4ee5\u52a0\u8f7d\u963f\u91cc\u4e91\u56fe\u7247\r\n        add_header Access-Control-Allow-Origin 'https:\/\/xxx.oss-cn-beijing.aliyuncs.com';<\/pre>\n<\/div>\n
 <\/p>\n
 <\/p>\n
 <\/p>\n
\u4ee5\u4e0b\u4e3a\u914d\u7f6e\u8bf4\u660e\uff1a<\/p>\n
\u53c2\u8003\u6587\u6863\uff1ahttps:\/\/blog.csdn.net\/youuzi\/article\/details\/132674960<\/a><\/p>\n
\u4e00\u3001\u524d\u8a00
\n\u6b64\u6587\u4e3b\u8981\u662f\u9488\u5bf9\u626b\u63cf\u5668\u5e38\u89c1\u7684\u4e00\u4e9b\u914d\u7f6e\u6027\u6f0f\u6d1e\u7684\u6982\u8ff0\u53ca\u5982\u4f55\u4fee\u590d\u7684\u4e00\u4e9b\u5efa\u8bae\u3002<\/p>\n
\u4e8c\u3001\u6f0f\u6d1e\u7c7b\u578b
\n2.1 Strict Transport Security Not Enforced
\n1\u3001\u539f\u7406<\/p>\n
“Strict Transport Security Not Enforced” \u662f\u4e00\u4e2a\u5b89\u5168\u6027\u8b66\u544a\uff0c\u901a\u5e38\u51fa\u73b0\u5728\u6d4f\u89c8\u5668\u7684\u5f00\u53d1\u8005\u5de5\u5177\u63a7\u5236\u53f0\u4e2d\uff0c\u8868\u660e\u7f51\u7ad9\u672a\u6b63\u786e\u6267\u884cHTTP Strict Transport Security\uff08HSTS\uff09\u7b56\u7565\u3002HSTS\u662f\u4e00\u79cd\u5b89\u5168\u673a\u5236\uff0c\u7528\u4e8e\u786e\u4fdd\u7528\u6237\u8bbf\u95ee\u7f51\u7ad9\u65f6\u59cb\u7ec8\u4f7f\u7528HTTPS\u8fde\u63a5\uff0c\u800c\u4e0d\u662f\u4e0d\u5b89\u5168\u7684HTTP\u8fde\u63a5\u3002<\/p>\n
HTTP Strict Transport Security (HSTS) \u662f\u4e00\u4e2aHTTP\u54cd\u5e94\u5934\uff0c\u670d\u52a1\u5668\u53ef\u4ee5\u4f7f\u7528\u5b83\u6765\u544a\u77e5\u6d4f\u89c8\u5668\u5728\u4e00\u6bb5\u65f6\u95f4\u5185\u4ec5\u4f7f\u7528HTTPS\u8fde\u63a5\u8bbf\u95ee\u7f51\u7ad9\u3002
\n\u5f53\u6d4f\u89c8\u5668\u9996\u6b21\u8bbf\u95ee\u652f\u6301HSTS\u7684\u7f51\u7ad9\u65f6\uff0c\u670d\u52a1\u5668\u4f1a\u53d1\u9001HSTS\u5934\uff0c\u6d4f\u89c8\u5668\u5c06\u8bb0\u4f4f\u8fd9\u4e2a\u7b56\u7565\u5e76\u5728\u4e4b\u540e\u7684\u4e00\u6bb5\u65f6\u95f4\u5185\uff08\u7531max-age\u6307\u5b9a\uff09\u5f3a\u5236\u4f7f\u7528HTTPS\u8fde\u63a5\u3002
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u542f\u7528HTTPS\uff1a \u786e\u4fdd\u60a8\u7684\u7f51\u7ad9\u5df2\u7ecf\u542f\u7528\u4e86HTTPS\uff0c\u5373\u5df2\u914d\u7f6e\u6709\u6548\u7684SSL\/TLS\u8bc1\u4e66\uff0c\u5e76\u4e14\u80fd\u591f\u901a\u8fc7HTTPS\u8bbf\u95ee\u3002\u5982\u679c\u60a8\u7684\u7f51\u7ad9\u4ecd\u7136\u5728\u4f7f\u7528HTTP\uff0c\u8bf7\u5347\u7ea7\u4e3aHTTPS\u3002<\/p>\n
\u6dfb\u52a0HSTS\u5934\uff1a \u5728\u60a8\u7684Web\u670d\u52a1\u5668\u914d\u7f6e\u4e2d\uff0c\u786e\u4fdd\u5df2\u6dfb\u52a0\u6b63\u786e\u7684HSTS\u5934\u3002\u4ee5\u4e0b\u662f\u4e00\u4e2a\u793a\u4f8bNginx\u914d\u7f6e\uff1a<\/p>\n
server {
\nlisten 443 ssl;
\nserver_name your_domain.com;<\/p>\n
ssl_certificate \/etc\/nginx\/ssl\/your_domain.crt;
\nssl_certificate_key \/etc\/nginx\/ssl\/your_domain.key;
\n# \u5176\u4ed6SSL\u914d\u7f6e…<\/p>\n
# \u542f\u7528HSTS\uff0c\u5e76\u8bbe\u7f6emax-age\u503c
\nadd_header Strict-Transport-Security “max-age=31536000; includeSubDomains” always;<\/p>\n
# \u5176\u4ed6\u670d\u52a1\u5668\u914d\u7f6e…
\n}<\/p>\n
#max-age \u503c\u8868\u793aHSTS\u7b56\u7565\u7684\u6709\u6548\u671f\uff08\u4ee5\u79d2\u4e3a\u5355\u4f4d\uff09\uff0c\u4e0a\u9762\u7684\u793a\u4f8b\u4e2d\u662f\u4e00\u5e74\u3002
\n#includeSubDomains \u544a\u8bc9\u6d4f\u89c8\u5668\u8981\u5e94\u7528HSTS\u7b56\u7565\u5230\u6240\u6709\u5b50\u57df\u540d\u3002<\/p>\n
\u6d4b\u8bd5HSTS\u7b56\u7565\uff1a \u4f7f\u7528\u6d4f\u89c8\u5668\u8bbf\u95ee\u60a8\u7684\u7f51\u7ad9\uff0c\u5e76\u68c0\u67e5\u5f00\u53d1\u8005\u5de5\u5177\u63a7\u5236\u53f0\u4e2d\u662f\u5426\u4e0d\u518d\u663e\u793a”Strict Transport Security Not Enforced”\u8b66\u544a\u3002\u786e\u4fdd\u6d4f\u89c8\u5668\u5df2\u7ecf\u6210\u529f\u8bb0\u4f4f\u4e86HSTS\u7b56\u7565\u3002<\/p>\n
\u5b9a\u671f\u66f4\u65b0\u8bc1\u4e66\u548c\u7b56\u7565\uff1a \u5b9a\u671f\u66f4\u65b0SSL\/TLS\u8bc1\u4e66\uff0c\u5e76\u786e\u4fddHSTS\u7b56\u7565\u7684 max-age \u503c\u8db3\u591f\u957f\uff0c\u4ee5\u4fdd\u6301\u957f\u671f\u6709\u6548\u6027\u3002<\/p>\n
PS\uff1aHSTS\u662f\u4e00\u4e2a\u5f3a\u5236\u6027\u7684\u5b89\u5168\u7b56\u7565\uff0c\u4e00\u65e6\u542f\u7528\uff0c\u6d4f\u89c8\u5668\u5c06\u59cb\u7ec8\u8981\u6c42\u4f7f\u7528HTTPS\u8fde\u63a5\uff0c\u5982\u679cSSL\u8bc1\u4e66\u8fc7\u671f\u6216\u4e0d\u53ef\u7528\uff0c\u7528\u6237\u53ef\u80fd\u65e0\u6cd5\u8bbf\u95ee\u60a8\u7684\u7f51\u7ad9\u3002\u56e0\u6b64\uff0c\u5728\u542f\u7528HSTS\u4e4b\u524d\uff0c\u8bf7\u786e\u4fdd\u60a8\u7684HTTPS\u914d\u7f6e\u6b63\u786e\u65e0\u8bef<\/p>\n
2.2 SSL Certificate Cannot Be Trusted
\n1\u3001\u6982\u8ff0<\/p>\n
“SSL Certificate Cannot Be Trusted” \u8868\u793a\u60a8\u7684\u6d4f\u89c8\u5668\u6216\u5ba2\u6237\u7aef\u5728\u5c1d\u8bd5\u5efa\u7acb\u5b89\u5168\u8fde\u63a5\u65f6\u9047\u5230\u4e86 SSL \u8bc1\u4e66\u7684\u4fe1\u4efb\u95ee\u9898\u3002\u8fd9\u901a\u5e38\u662f\u7531\u4ee5\u4e0b\u51e0\u4e2a\u539f\u56e0\u5f15\u8d77\u7684\uff1a<\/p>\n
\u8bc1\u4e66\u8fc7\u671f\uff1a SSL \u8bc1\u4e66\u5177\u6709\u6709\u6548\u671f\u9650\uff0c\u4e00\u65e6\u8bc1\u4e66\u8fc7\u671f\uff0c\u6d4f\u89c8\u5668\u6216\u5ba2\u6237\u7aef\u5c06\u4e0d\u4fe1\u4efb\u8be5\u8bc1\u4e66\u3002\u89e3\u51b3\u65b9\u6cd5\u662f\u66f4\u65b0\u6216\u7eed\u8ba2\u8bc1\u4e66\u3002<\/p>\n
\u81ea\u7b7e\u540d\u8bc1\u4e66\uff1a \u5982\u679c\u60a8\u4f7f\u7528\u81ea\u7b7e\u540d\u8bc1\u4e66\u800c\u4e0d\u662f\u7531\u53d7\u4fe1\u4efb\u7684\u7b2c\u4e09\u65b9\u8bc1\u4e66\u9881\u53d1\u673a\u6784\uff08CA\uff09\u7b7e\u53d1\u7684\u8bc1\u4e66\uff0c\u90a3\u4e48\u6d4f\u89c8\u5668\u6216\u5ba2\u6237\u7aef\u53ef\u80fd\u4e0d\u4fe1\u4efb\u5b83\u3002\u89e3\u51b3\u65b9\u6cd5\u662f\u4f7f\u7528\u53d7\u4fe1\u4efb\u7684 CA \u9881\u53d1\u7684\u8bc1\u4e66\u3002<\/p>\n
\u4e0d\u5339\u914d\u7684\u57df\u540d\uff1a SSL \u8bc1\u4e66\u901a\u5e38\u4e0e\u7279\u5b9a\u7684\u57df\u540d\u6216\u5b50\u57df\u540d\u76f8\u5173\u8054\u3002\u5982\u679c\u60a8\u4f7f\u7528\u8bc1\u4e66\u4e0e\u5f53\u524d\u8bbf\u95ee\u7684\u57df\u540d\u4e0d\u5339\u914d\uff0c\u4e5f\u4f1a\u5bfc\u81f4\u6b64\u95ee\u9898\u3002\u786e\u4fdd\u60a8\u7684\u8bc1\u4e66\u4e0e\u60a8\u7684\u57df\u540d\u5339\u914d\u3002<\/p>\n
\u53d7\u4fe1\u4efb CA \u6839\u8bc1\u4e66\u4e22\u5931\u6216\u8fc7\u671f\uff1a \u6d4f\u89c8\u5668\u6216\u64cd\u4f5c\u7cfb\u7edf\u4e2d\u7684\u53d7\u4fe1\u4efb\u6839\u8bc1\u4e66\u53ef\u80fd\u5df2\u8fc7\u671f\u6216\u4e22\u5931\u3002\u60a8\u53ef\u4ee5\u66f4\u65b0\u6d4f\u89c8\u5668\u3001\u64cd\u4f5c\u7cfb\u7edf\u6216 CA \u6839\u8bc1\u4e66\u5b58\u50a8\u4ee5\u89e3\u51b3\u6b64\u95ee\u9898\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u68c0\u67e5\u8bc1\u4e66\u8fc7\u671f\uff1a \u786e\u4fdd\u60a8\u7684 SSL \u8bc1\u4e66\u6ca1\u6709\u8fc7\u671f\uff0c\u5982\u679c\u8fc7\u671f\u4e86\uff0c\u8054\u7cfb\u8bc1\u4e66\u9881\u53d1\u673a\u6784\u4ee5\u83b7\u5f97\u65b0\u7684\u8bc1\u4e66\u3002<\/p>\n
\u4f7f\u7528\u53d7\u4fe1\u4efb\u7684 CA \u8bc1\u4e66\uff1a \u5982\u679c\u60a8\u4f7f\u7528\u81ea\u7b7e\u540d\u8bc1\u4e66\uff0c\u8003\u8651\u4f7f\u7528\u7531\u53d7\u4fe1\u4efb\u7684\u7b2c\u4e09\u65b9 CA \u9881\u53d1\u7684\u8bc1\u4e66\uff0c\u4ee5\u786e\u4fdd\u6d4f\u89c8\u5668\u6216\u5ba2\u6237\u7aef\u4fe1\u4efb\u5b83\u3002<\/p>\n
\u9a8c\u8bc1\u57df\u540d\u5339\u914d\uff1a \u786e\u4fdd\u8bc1\u4e66\u4e0e\u60a8\u5f53\u524d\u8bbf\u95ee\u7684\u57df\u540d\u5339\u914d\u3002\u5982\u679c\u4e0d\u5339\u914d\uff0c\u9700\u8981\u83b7\u53d6\u76f8\u5e94\u57df\u540d\u7684\u8bc1\u4e66\u3002<\/p>\n
\u66f4\u65b0\u53d7\u4fe1\u4efb\u7684 CA \u6839\u8bc1\u4e66\uff1a \u5982\u679c\u6d4f\u89c8\u5668\u6216\u64cd\u4f5c\u7cfb\u7edf\u4e2d\u7684 CA \u6839\u8bc1\u4e66\u5df2\u8fc7\u671f\u6216\u4e22\u5931\uff0c\u66f4\u65b0\u5b83\u4eec\u4ee5\u786e\u4fdd\u6b63\u786e\u7684\u4fe1\u4efb\u94fe\u3002<\/p>\n
2.3 SSL Anonymous Cipher Suites Supported
\n1\u3001\u6982\u8ff0<\/p>\n
“SSL Anonymous Cipher Suites Supported” \u8868\u793a\u670d\u52a1\u5668\u652f\u6301\u533f\u540d\u52a0\u5bc6\u5957\u4ef6\uff0c\u8fd9\u662f\u4e00\u79cd\u4e0d\u5b89\u5168\u7684\u914d\u7f6e\uff0c\u56e0\u4e3a\u533f\u540d\u52a0\u5bc6\u5957\u4ef6\u4e0d\u8981\u6c42\u5ba2\u6237\u7aef\u63d0\u4f9b\u8eab\u4efd\u9a8c\u8bc1\uff0c\u8fd9\u53ef\u80fd\u4f1a\u5bfc\u81f4\u5b89\u5168\u6f0f\u6d1e\u3002\u4fee\u590d\u6b64\u95ee\u9898\u7684\u65b9\u6cd5\u662f\u7981\u7528\u533f\u540d\u52a0\u5bc6\u5957\u4ef6\u5e76\u914d\u7f6e\u66f4\u5b89\u5168\u7684\u52a0\u5bc6\u5957\u4ef6\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u66f4\u65b0\u670d\u52a1\u5668\u914d\u7f6e\uff1a \u6253\u5f00\u670d\u52a1\u5668\u914d\u7f6e\u6587\u4ef6\uff0c\u901a\u5e38\u662fWeb\u670d\u52a1\u5668\uff08\u5982Apache\u3001Nginx\uff09\u6216TLS\/SSL\u4e2d\u95f4\u4ef6\uff08\u5982OpenSSL\uff09\u7684\u914d\u7f6e\u6587\u4ef6\u3002\u67e5\u627e\u5e76\u7981\u7528\u533f\u540d\u52a0\u5bc6\u5957\u4ef6\u3002\u5177\u4f53\u7684\u914d\u7f6e\u9009\u9879\u548c\u8bed\u6cd5\u53ef\u80fd\u56e0\u670d\u52a1\u5668\u8f6f\u4ef6\u800c\u5f02\u3002<\/p>\n
\u914d\u7f6e\u52a0\u5bc6\u5957\u4ef6\uff1a \u914d\u7f6e\u670d\u52a1\u5668\u4ee5\u4f7f\u7528\u66f4\u5b89\u5168\u7684\u52a0\u5bc6\u5957\u4ef6\uff0c\u4f8b\u5982\u652f\u6301\u53cc\u5411\u8eab\u4efd\u9a8c\u8bc1\u7684\u5957\u4ef6\u3002\u786e\u4fdd\u9009\u62e9\u7684\u5957\u4ef6\u5177\u6709\u8db3\u591f\u7684\u5b89\u5168\u6027\uff0c\u5e76\u4e0e\u60a8\u7684\u5b89\u5168\u9700\u6c42\u76f8\u5339\u914d\u3002<\/p>\n
\u91cd\u65b0\u542f\u52a8\u670d\u52a1\u5668\uff1a \u5728\u66f4\u65b0\u670d\u52a1\u5668\u914d\u7f6e\u540e\uff0c\u91cd\u65b0\u542f\u52a8\u670d\u52a1\u5668\u4ee5\u4f7f\u66f4\u6539\u751f\u6548\u3002<\/p>\n
#\u4f7f\u7528nmap\u68c0\u6d4b\u652f\u6301\u7684\u7b97\u6cd5
\nnmap -sV -p 443 –script ssl-enum-ciphers xx.xx.xx.xx
\n\u90e8\u5206\u914d\u7f6e\u4e3e\u4f8b<\/p>\n
ssl_prefer_server_ciphers on;
\nssl_ciphers ‘HIGH:!aNULL:!eNULL:!EXPORT:!LOW:!MD5:!RC4:!3DES:!PSK:!SRP:!DSS:!CAMELLIA:!SEED’;<\/p>\n
#\u63a8\u8350\u914d\u7f6e\uff1a
\nssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!3DES:!ADH:!RC4:!DH:!DHE:!IDEA:!DES;
\nssl_prefer_server_ciphers on;\uff1a\u6b64\u6307\u4ee4\u544a\u8bc9\u670d\u52a1\u5668\u4f18\u5148\u4f7f\u7528\u670d\u52a1\u5668\u7aef\u7684\u52a0\u5bc6\u5957\u4ef6\u987a\u5e8f\uff0c\u4ee5\u786e\u4fdd\u5ba2\u6237\u7aef\u4f7f\u7528\u7684\u662f\u670d\u52a1\u5668\u8ba4\u4e3a\u66f4\u5b89\u5168\u7684\u5957\u4ef6\u3002<\/p>\n
ssl_ciphers\uff1a\u8fd9\u662f\u7528\u4e8e\u914d\u7f6e\u52a0\u5bc6\u5957\u4ef6\u7684\u5730\u65b9\u3002\u5728\u4e0a\u8ff0\u914d\u7f6e\u4e2d\uff0c\u6211\u4eec\u4f7f\u7528\u4e86\u4e00\u7cfb\u5217\u53c2\u6570\u548c\u52a0\u5bc6\u5957\u4ef6\u540d\u79f0\uff0c\u4ee5\u5b9a\u4e49\u5141\u8bb8\u4f7f\u7528\u7684\u52a0\u5bc6\u5957\u4ef6\u3002HIGH \u8868\u793a\u4f7f\u7528\u9ad8\u5f3a\u5ea6\u7684\u52a0\u5bc6\u5957\u4ef6\uff0c\u800c\u540e\u9762\u7684 :!aNULL:!eNULL:!EXPORT:!LOW:!MD5:!RC4:!3DES:!PSK:!SRP:!DSS:!CAMELLIA:!SEED \u90e8\u5206\u662f\u7528\u4e8e\u7981\u7528\u7279\u5b9a\u7684\u52a0\u5bc6\u5957\u4ef6\u7c7b\u578b\uff0c\u5305\u62ec\u533f\u540d\u52a0\u5bc6\u5957\u4ef6\u3002<\/p>\n
PS\uff1a\u8981\u4e25\u683c\u4f7f\u7528\u5b89\u5168\u7b97\u6cd5\u7684\u8bdd\uff0c\u53ef\u53c2\u8003Ciphersuite Info<\/p>\n
2.4 “Referrer Policy\u201dSecurity \u5934\u503c\u4e0d\u5b89\u5168
\n1\u3001\u6982\u8ff0<\/p>\n
“Referrer Policy” \u662f\u4e00\u79cd\u5b89\u5168\u76f8\u5173\u7684HTTP\u5934\uff0c\u7528\u4e8e\u63a7\u5236\u6d4f\u89c8\u5668\u5728\u53d1\u9001\u8bf7\u6c42\u65f6\uff0c\u662f\u5426\u5305\u542b\u5f15\u7528\u9875\u9762\u7684\u4fe1\u606f\uff08Referrer\uff09\u3002Referrer \u662f\u6307\u544a\u8bc9\u670d\u52a1\u5668\u8bf7\u6c42\u662f\u4ece\u54ea\u4e2a\u9875\u9762\u94fe\u63a5\u8fc7\u6765\u7684\u4fe1\u606f\u3002\u8fd9\u4e2a\u5934\u7684\u503c\u53ef\u4ee5\u8bbe\u7f6e\u4e3a\u4e0d\u540c\u7684\u7b56\u7565\uff0c\u4ee5\u51b3\u5b9a\u662f\u5426\u8981\u53d1\u9001 Referrer \u4fe1\u606f\uff0c\u4ee5\u53ca\u8981\u53d1\u9001\u7684\u4fe1\u606f\u5185\u5bb9\u3002<\/p>\n
“Referrer Policy” \u5934\u503c\u4e0d\u5b89\u5168\u901a\u5e38\u662f\u6307\u670d\u52a1\u5668\u7684\u8bbe\u7f6e\u5141\u8bb8\u4e86\u8fc7\u4e8e\u5e7f\u6cdb\u6216\u4e0d\u5b89\u5168\u7684 Referrer \u4fe1\u606f\u4f20\u9012\uff0c\u53ef\u80fd\u5bfc\u81f4\u4fe1\u606f\u6cc4\u9732\u3001\u9690\u79c1\u95ee\u9898\u6216\u5b89\u5168\u6f0f\u6d1e\u3002\u4fee\u590d\u8fd9\u4e2a\u95ee\u9898\u7684\u5173\u952e\u5728\u4e8e\u5c06 “Referrer Policy” \u8bbe\u7f6e\u4e3a\u66f4\u4e3a\u5b89\u5168\u7684\u7b56\u7565\uff0c\u4ee5\u51cf\u5c11\u4fe1\u606f\u6cc4\u9732\u7684\u98ce\u9669\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u5e38\u89c1\u4fee\u590d\u63aa\u65bd\uff1a<\/p>\n
Strict-origin-when-cross-origin \u7b56\u7565\uff1a \u8fd9\u662f\u4e00\u79cd\u76f8\u5bf9\u5b89\u5168\u7684\u7b56\u7565\uff0c\u5b83\u5728\u540c\u4e00\u7ad9\u70b9\u4e4b\u95f4\u53d1\u9001\u5b8c\u6574\u7684 Referrer\uff0c\u4f46\u5728\u8de8\u7ad9\u70b9\u8bf7\u6c42\u65f6\u4ec5\u53d1\u9001 Origin \u90e8\u5206\u3002\u8fd9\u6709\u52a9\u4e8e\u4fdd\u62a4\u7528\u6237\u9690\u79c1\uff0c\u4f46\u4ecd\u63d0\u4f9b\u4e86\u6709\u7528\u7684\u4fe1\u606f\u3002
\nReferrer-Policy: strict-origin-when-cross-origin
\nNo-Referrer \u7b56\u7565\uff1a \u8fd9\u662f\u6700\u5b89\u5168\u7684\u7b56\u7565\uff0c\u5b8c\u5168\u7981\u7528\u4e86 Referrer \u4fe1\u606f\u7684\u4f20\u9012\u3002\u8fd9\u53ef\u4ee5\u9632\u6b62\u4fe1\u606f\u6cc4\u9732\uff0c\u4f46\u53ef\u80fd\u4f1a\u7834\u574f\u4e00\u4e9b\u7f51\u7ad9\u529f\u80fd\u3002
\nReferrer-Policy: no-referrer
\nSame-origin \u7b56\u7565\uff1a \u8fd9\u4e2a\u7b56\u7565\u53ea\u5728\u540c\u4e00\u7ad9\u70b9\u5185\u53d1\u9001 Referrer \u4fe1\u606f\uff0c\u4e0d\u4f1a\u5728\u8de8\u7ad9\u70b9\u8bf7\u6c42\u65f6\u53d1\u9001\u3002
\nReferrer-Policy: same-origin
\n\u5b89\u5168\u81ea\u5b9a\u4e49\u7b56\u7565\uff1a \u60a8\u53ef\u4ee5\u6839\u636e\u60a8\u7684\u7f51\u7ad9\u9700\u6c42\uff0c\u81ea\u5b9a\u4e49\u5b89\u5168\u7684 Referrer \u7b56\u7565\uff0c\u4ee5\u5e73\u8861\u9690\u79c1\u548c\u529f\u80fd\u9700\u6c42\u3002
\n\u914d\u7f6e\u65b9\u5f0f\uff1a<\/p>\n
Nginx\u914d\u7f6e\u6587\u4ef6\u4e2d\u52a0\u4e0a
\nadd_header Referrer-Policy “strict-origin-when-cross-origin” always;
\n2.5 \u201cContent-Security-Policy\u201d\u5934\u7f3a\u5931
\n1\u3001\u6982\u8ff0<\/p>\n
“Content-Security-Policy”\uff08CSP\uff09\u662f\u4e00\u79cd\u91cd\u8981\u7684HTTP\u5934\uff0c\u7528\u4e8e\u5e2e\u52a9\u9632\u6b62\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff08XSS\uff09\u548c\u5176\u4ed6\u5b89\u5168\u5a01\u80c1\u3002\u5b83\u5141\u8bb8\u60a8\u660e\u786e\u5b9a\u4e49\u5141\u8bb8\u52a0\u8f7d\u548c\u6267\u884c\u7684\u8d44\u6e90\u6e90\u70b9\uff0c\u4ece\u800c\u51cf\u5c11\u6076\u610f\u811a\u672c\u7684\u98ce\u9669\u3002\u5f53\u7f51\u7ad9\u672a\u914d\u7f6eCSP\u5934\u65f6\uff0c\u53ef\u80fd\u4f1a\u5b58\u5728\u5b89\u5168\u98ce\u9669\u3002<\/p>\n
CSP\u901a\u8fc7\u5728HTTP\u5934\u4e2d\u5b9a\u4e49\u7b56\u7565\uff0c\u544a\u8bc9\u6d4f\u89c8\u5668\u53ea\u5141\u8bb8\u4ece\u7279\u5b9a\u6e90\u52a0\u8f7d\u5185\u5bb9\u3002\u8fd9\u53ef\u4ee5\u5305\u62ec\u811a\u672c\u3001\u6837\u5f0f\u3001\u56fe\u50cf\u3001\u5b57\u4f53\u7b49\u8d44\u6e90\u3002
\nCSP\u8fd8\u53ef\u4ee5\u5b9a\u4e49\u4e0d\u5141\u8bb8\u6267\u884c\u5185\u8054\u811a\u672c\uff08\u4f8b\u5982\uff0c <script> \u5143\u7d20\u5185\u7684JavaScript\uff09\u548c\u4e0d\u5141\u8bb8\u6267\u884c\u5185\u8054\u6837\u5f0f\uff08\u4f8b\u5982\uff0c <style> \u5143\u7d20\u5185\u7684CSS\uff09\u3002
\n\u5982\u679c\u7f51\u7ad9\u672a\u914d\u7f6eCSP\uff0c\u653b\u51fb\u8005\u53ef\u80fd\u80fd\u591f\u6ce8\u5165\u6076\u610f\u811a\u672c\u6216\u5185\u5bb9\uff0c\u4ece\u800c\u5a01\u80c1\u7528\u6237\u7684\u9690\u79c1\u548c\u5b89\u5168\u3002
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u5e38\u89c1\u4fee\u590d\u63aa\u65bd\uff1a<\/p>\n
\u5b9a\u4e49\u7b56\u7565\uff1a \u5b9a\u4e49\u9002\u5408\u60a8\u7f51\u7ad9\u9700\u6c42\u7684CSP\u7b56\u7565\u3002\u60a8\u53ef\u4ee5\u4f7f\u7528\u4e0d\u540c\u7684\u6307\u4ee4\u6765\u63a7\u5236\u4e0d\u540c\u7c7b\u578b\u8d44\u6e90\u7684\u52a0\u8f7d\uff0c\u4f8b\u5982 default-src\u3001script-src\u3001style-src\u3001img-src \u7b49\u3002<\/p>\n
\u914d\u7f6eHTTP\u5934\uff1a \u5728\u60a8\u7684Web\u670d\u52a1\u5668\u914d\u7f6e\u6216\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\u4e2d\u6dfb\u52a0CSP\u5934\u3002\u4ee5\u4e0b\u662f\u4e00\u4e2a\u793a\u4f8b\uff08\u6ce8\u610f\uff0c\u8fd9\u53ea\u662f\u4e00\u4e2a\u7b80\u5316\u7684\u793a\u4f8b\uff0c\u60a8\u9700\u8981\u6839\u636e\u60a8\u7684\u9700\u6c42\u8fdb\u884c\u914d\u7f6e\uff09\uff1a<\/p>\n
Content-Security-Policy: default-src ‘self’; script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’ https:\/\/cdn.example.com;<\/p>\n
#\u5728\u6b64\u793a\u4f8b\u4e2d\uff0c\u7b56\u7565\u5141\u8bb8\u52a0\u8f7d\u6765\u81ea\u540c\u4e00\u7ad9\u70b9\uff08’self’\uff09\u7684\u9ed8\u8ba4\u8d44\u6e90\uff0c\u5141\u8bb8\u5185\u8054\u811a\u672c\u548c\u52a8\u6001\u6267\u884c\u811a\u672c\uff08\u8bf7\u5c0f\u5fc3\u4f7f\u7528 ‘unsafe-inline’ \u548c ‘unsafe-eval’\uff0c\u4ec5\u5728\u5fc5\u8981\u65f6\u4f7f\u7528\uff09\uff0c\u5e76\u5141\u8bb8\u52a0\u8f7d\u6765\u81eacdn.example.com\u7684\u811a\u672c
\ndefault-src: \u6307\u5b9a\u4e86\u9ed8\u8ba4\u7684\u8d44\u6e90\u52a0\u8f7d\u6e90\u70b9\uff0c\u5982\u679c\u672a\u6307\u5b9a\u5176\u4ed6\u7279\u5b9a\u6e90\u70b9\uff0c\u5c06\u5e94\u7528\u4e8e\u6240\u6709\u8d44\u6e90\u7c7b\u578b\u3002\u5728\u793a\u4f8b\u4e2d\uff0c’self’ \u8868\u793a\u53ea\u5141\u8bb8\u52a0\u8f7d\u6765\u81ea\u540c\u4e00\u7ad9\u70b9\u7684\u8d44\u6e90\u3002\u8fd9\u6709\u52a9\u4e8e\u9632\u6b62\u8de8\u7ad9\u70b9\u811a\u672c\u653b\u51fb (XSS)\u3002<\/p>\n
script-src: \u6307\u5b9a\u4e86\u5141\u8bb8\u52a0\u8f7dJavaScript\u811a\u672c\u7684\u6e90\u70b9\u3002\u5728\u793a\u4f8b\u4e2d\uff0c’self’ \u8868\u793a\u53ea\u5141\u8bb8\u52a0\u8f7d\u6765\u81ea\u540c\u4e00\u7ad9\u70b9\u7684JavaScript\uff0c’unsafe-inline’ \u5141\u8bb8\u5185\u8054\u811a\u672c\uff0c’unsafe-eval’ \u5141\u8bb8\u52a8\u6001\u6267\u884c\u811a\u672c\uff0c\u800c https:\/\/cdn.example.com \u5141\u8bb8\u52a0\u8f7d\u6765\u81ea\u6307\u5b9aCDN\u7684\u811a\u672c\u3002\u8bf7\u6ce8\u610f\uff0c\u4f7f\u7528 ‘unsafe-inline’ \u548c ‘unsafe-eval’ \u4f1a\u589e\u52a0\u5b89\u5168\u98ce\u9669\uff0c\u6700\u597d\u53ea\u5728\u5fc5\u8981\u65f6\u4f7f\u7528\u3002<\/p>\n
style-src: \u6307\u5b9a\u4e86\u5141\u8bb8\u52a0\u8f7dCSS\u6837\u5f0f\u8868\u7684\u6e90\u70b9\u3002\u5728\u793a\u4f8b\u4e2d\uff0c’self’ \u8868\u793a\u53ea\u5141\u8bb8\u52a0\u8f7d\u6765\u81ea\u540c\u4e00\u7ad9\u70b9\u7684\u6837\u5f0f\u8868\u3002<\/p>\n
img-src: \u6307\u5b9a\u4e86\u5141\u8bb8\u52a0\u8f7d\u56fe\u50cf\u7684\u6e90\u70b9\u3002\u5728\u793a\u4f8b\u4e2d\uff0c’self’ \u8868\u793a\u53ea\u5141\u8bb8\u52a0\u8f7d\u6765\u81ea\u540c\u4e00\u7ad9\u70b9\u7684\u56fe\u50cf\u3002<\/p>\n
\u8fd9\u4e9b\u6307\u4ee4\u662f CSP \u4e2d\u7684\u4e00\u90e8\u5206\uff0c\u60a8\u53ef\u4ee5\u6839\u636e\u60a8\u7684\u7f51\u7ad9\u9700\u6c42\u8fdb\u884c\u81ea\u5b9a\u4e49\u3002\u9664\u4e86\u4e0a\u8ff0\u793a\u4f8b\u4e2d\u7684\u6307\u4ee4\u5916\uff0c\u8fd8\u6709\u5176\u4ed6\u53ef\u7528\u7684\u6307\u4ee4\uff0c\u5982 connect-src\uff08\u7528\u4e8eXHR\u3001WebSocket\u7b49\u8fde\u63a5\uff09\u3001font-src\uff08\u7528\u4e8e\u5b57\u4f53\u6587\u4ef6\uff09\u3001media-src\uff08\u7528\u4e8e\u97f3\u9891\u548c\u89c6\u9891\u6587\u4ef6\uff09\u7b49\u3002<\/p>\n
PS\uff1a”Content-Security-Policy” \u5934\u7684\u76ee\u6807\u662f\u589e\u52a0\u7f51\u7ad9\u7684\u5b89\u5168\u6027\uff0c\u51cf\u5c11\u6f5c\u5728\u7684\u5b89\u5168\u5a01\u80c1\u3002\u914d\u7f6eCSP\u9700\u8981\u8c28\u614e\u548c\u6d4b\u8bd5\uff0c\u4ee5\u786e\u4fdd\u4e0d\u4f1a\u5f71\u54cd\u7f51\u7ad9\u7684\u6b63\u5e38\u8fd0\u884c\u3002<\/p>\n
nginx\u914d\u7f6e\u6587\u4ef6\u914d\u7f6e\u53c2\u8003\uff1a<\/p>\n
add_header Content-Security-Policy “frame-ancestors ‘self’ https:\/\/x.x.x.x; object-src ‘none’; script-src ‘self’ https:\/\/x.x.x.x”;
\n2.6 \u5177\u6709\u4e0d\u5b89\u5168\u3001\u4e0d\u6b63\u786e\u6216\u7f3a\u5c11 SameSite \u5c5e\u6027\u7684 Cookie
\n1\u3001\u6982\u8ff0<\/p>\n
“SameSite” \u5c5e\u6027\u662f\u4e00\u79cd\u7528\u4e8e\u589e\u5f3aCookie\u5b89\u5168\u6027\u548c\u9690\u79c1\u7684\u6807\u5fd7\uff0c\u5b83\u544a\u8bc9\u6d4f\u89c8\u5668\u4ec0\u4e48\u60c5\u51b5\u4e0b\u53ef\u4ee5\u53d1\u9001Cookie\u3002\u5177\u6709\u4e0d\u5b89\u5168\u3001\u4e0d\u6b63\u786e\u6216\u7f3a\u5c11 “SameSite” \u5c5e\u6027\u7684Cookie\u53ef\u80fd\u4f1a\u5bfc\u81f4\u5b89\u5168\u548c\u9690\u79c1\u95ee\u9898\u3002<\/p>\n
“SameSite” \u5c5e\u6027\u6709\u4e09\u4e2a\u53ef\u80fd\u7684\u503c\uff1aStrict\u3001Lax \u548c None\u3002
\nStrict \u8868\u793aCookie\u4ec5\u5728\u5b8c\u5168\u76f8\u540c\u7684\u7ad9\u70b9\u4e0a\u53d1\u9001\uff0c\u4e0d\u5141\u8bb8\u8de8\u7ad9\u70b9\u53d1\u9001\u3002
\nLax \u8868\u793aCookie\u5728\u5bfc\u822a\u5230\u5176\u4ed6\u7ad9\u70b9\u4e4b\u524d\u4f1a\u53d1\u9001\uff0c\u4f8b\u5982\u901a\u8fc7\u70b9\u51fb\u94fe\u63a5\u3002
\nNone \u8868\u793aCookie\u59cb\u7ec8\u53d1\u9001\uff0c\u65e0\u8bba\u7ad9\u70b9\u662f\u5426\u76f8\u540c\u3002
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u8bbe\u7f6e “SameSite” \u5c5e\u6027\uff1a \u4e3a\u60a8\u7684Cookie\u8bbe\u7f6e\u9002\u5f53\u7684 “SameSite” \u5c5e\u6027\u3002\u901a\u5e38\u60c5\u51b5\u4e0b\uff0c\u6700\u597d\u4f7f\u7528 SameSite=Strict \u6216 SameSite=Lax \u6765\u9650\u5236Cookie\u7684\u53d1\u9001\u3002\u8fd9\u6709\u52a9\u4e8e\u9632\u6b62\u8de8\u7ad9\u70b9\u8bf7\u6c42\u4f2a\u9020\uff08CSRF\uff09\u548c\u67d0\u4e9b\u7c7b\u578b\u7684\u8de8\u7ad9\u70b9\u811a\u672c\u653b\u51fb\uff08XSS\uff09\u3002<\/p>\n
\u4f7f\u7528 “None” \u53ea\u5728\u9700\u8981\u65f6\uff1a \u5982\u679c\u60a8\u7684\u5e94\u7528\u9700\u8981\u5728\u8de8\u7ad9\u70b9\u60c5\u51b5\u4e0b\u5171\u4eabCookie\uff0c\u53ef\u4ee5\u4f7f\u7528 SameSite=None\u3002\u7136\u800c\uff0c\u8981\u4f7f\u7528 “None” \u503c\uff0c\u8fd8\u5fc5\u987b\u8bbe\u7f6e “Secure” \u5c5e\u6027\uff0c\u4ee5\u786e\u4fdd\u4ec5\u5728HTTPS\u8fde\u63a5\u4e0b\u53d1\u9001Cookie\u3002<\/p>\n
Set-Cookie: mycookie=myvalue; SameSite=None; Secure
\n\u907f\u514d\u7f3a\u5c11 SameSite \u5c5e\u6027\uff1a \u5c3d\u91cf\u907f\u514d\u8bbe\u7f6e\u7f3a\u5c11 “SameSite” \u5c5e\u6027\u7684Cookie\u3002\u5982\u679cCookie\u6ca1\u6709\u6307\u5b9a “SameSite” \u5c5e\u6027\uff0c\u5927\u591a\u6570\u6d4f\u89c8\u5668\u5c06\u9ed8\u8ba4\u4e3a “Lax”\uff0c\u4f46\u8fd9\u53ef\u80fd\u4e0d\u662f\u60a8\u60f3\u8981\u7684\u884c\u4e3a\u3002
\n\u914d\u7f6e\u53c2\u8003\uff1a\uff08ps\uff1a\u4f1a\u5f71\u54cdhttp\u8bbf\u95ee\uff0c\u6700\u597d\u914d\u5408\u7ad9\u70b9\u5f3a\u5236https\u8bbf\u95ee\uff09<\/p>\n
proxy_cookie_path \/ “\/; httponly; secure; SameSite=Lax”;
\n2.7 \u52a0\u5bc6\u4f1a\u8bdd (SSL) Cookie \u4e2d\u7f3a\u5c11 Secure \u5c5e\u6027
\n1\u3001\u6982\u8ff0<\/p>\n
\u5728\u5b89\u5168\u5957\u63a5\u5b57\u5c42\uff08SSL\/TLS\uff09\u4e0a\u4f7f\u7528\u7684 Cookie \u5e94\u5f53\u914d\u7f6e “Secure” \u5c5e\u6027\u4ee5\u589e\u52a0\u5b89\u5168\u6027\u3002”Secure” \u5c5e\u6027\u544a\u8bc9\u6d4f\u89c8\u5668\u53ea\u6709\u5728\u5b89\u5168\u7684 HTTPS \u8fde\u63a5\u4e0b\u624d\u53d1\u9001\u8be5 Cookie\uff0c\u4ee5\u4fdd\u62a4\u654f\u611f\u6570\u636e\u4e0d\u88ab\u4e0d\u5b89\u5168\u7684 HTTP \u8fde\u63a5\u83b7\u53d6\u3002\u7f3a\u5c11 “Secure” \u5c5e\u6027\u7684 Cookie \u53ef\u80fd\u53d7\u5230\u4e2d\u95f4\u4eba\u653b\u51fb\u548c\u6570\u636e\u6cc4\u9732\u7684\u5a01\u80c1\u3002<\/p>\n
“Secure” \u5c5e\u6027\u662f\u4e00\u4e2aCookie\u7684\u5c5e\u6027\uff0c\u7528\u4e8e\u6307\u5b9aCookie\u662f\u5426\u53ea\u80fd\u901a\u8fc7\u5b89\u5168\u7684HTTPS\u8fde\u63a5\u4f20\u8f93\u3002
\n\u5f53Cookie\u5177\u6709 “Secure” \u5c5e\u6027\u65f6\uff0c\u6d4f\u89c8\u5668\u53ea\u4f1a\u5728HTTPS\u8fde\u63a5\u4e0b\u53d1\u9001\u8be5Cookie\u3002\u5982\u679c\u7528\u6237\u5c1d\u8bd5\u901a\u8fc7HTTP\u8fde\u63a5\u8bbf\u95ee\u7f51\u7ad9\uff0c\u8be5Cookie\u5c06\u4e0d\u4f1a\u88ab\u53d1\u9001\u6216\u63a5\u53d7\u3002
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u4e3a\u654f\u611f\u6570\u636e\u542f\u7528HTTPS\uff1a \u9996\u5148\uff0c\u786e\u4fdd\u60a8\u7684\u7f51\u7ad9\u542f\u7528\u4e86HTTPS\u3002\u8fd9\u9700\u8981\u83b7\u5f97\u5e76\u5b89\u88c5\u6709\u6548\u7684SSL\/TLS\u8bc1\u4e66\u3002\u60a8\u53ef\u4ee5\u4ece\u4fe1\u4efb\u7684\u8bc1\u4e66\u9881\u53d1\u673a\u6784\uff08CA\uff09\u83b7\u53d6\u8bc1\u4e66\u6216\u4f7f\u7528\u514d\u8d39\u7684\u8bc1\u4e66\u9881\u53d1\u673a\u6784\uff0c\u5982Let’s Encrypt\u3002<\/p>\n
\u914d\u7f6eCookie\u7684Secure\u5c5e\u6027\uff1a \u5f53\u60a8\u5728\u670d\u52a1\u5668\u7aef\u8bbe\u7f6eCookie\u65f6\uff0c\u8bf7\u786e\u4fdd\u4e3a\u5305\u542b\u654f\u611f\u6570\u636e\u7684Cookie\u6dfb\u52a0 “Secure” \u5c5e\u6027\u3002\u793a\u4f8b\uff1a<\/p>\n
Set-Cookie: mycookie=myvalue; Secure
\n\u8fd9\u5c06\u786e\u4fdd\u8be5Cookie\u53ea\u80fd\u5728HTTPS\u8fde\u63a5\u4e0b\u4f20\u8f93\u3002<\/p>\n
\u4fee\u590d\u65e7Cookie\uff1a \u5982\u679c\u60a8\u7684\u7f51\u7ad9\u4e4b\u524d\u521b\u5efa\u4e86\u4e0d\u5e26 “Secure” \u5c5e\u6027\u7684Cookie\uff0c\u60a8\u9700\u8981\u66f4\u65b0\u8fd9\u4e9bCookie\u4ee5\u6dfb\u52a0 “Secure” \u5c5e\u6027\u3002\u8fd9\u53ef\u80fd\u9700\u8981\u5bf9\u5e94\u7528\u7a0b\u5e8f\u7684\u4ee3\u7801\u6216\u670d\u52a1\u5668\u914d\u7f6e\u8fdb\u884c\u4e00\u4e9b\u4fee\u6539\u3002
\nNginx\u914d\u7f6e\u793a\u4f8b\uff1a\uff08\u540csamesite\u5c5e\u6027\u914d\u7f6e\uff09<\/p>\n
proxy_cookie_path \/ “\/; httponly; secure; SameSite=Lax”;
\n2.8 \u53d1\u73b0\u53ef\u9ad8\u901f\u7f13\u5b58\u7684 SSL \u9875\u9762
\n1\u3001\u6982\u8ff0<\/p>\n
\u53d1\u73b0\u53ef\u9ad8\u901f\u7f13\u5b58\u7684 SSL \u9875\u9762\u53ef\u80fd\u6d89\u53ca\u5230\u4e00\u4e9b\u5b89\u5168\u6027\u548c\u9690\u79c1\u65b9\u9762\u7684\u95ee\u9898\uff0c\u56e0\u4e3aSSL\u9875\u9762\u901a\u5e38\u5305\u542b\u654f\u611f\u4fe1\u606f\uff0c\u5982\u7528\u6237\u767b\u5f55\u51ed\u636e\u6216\u4e2a\u4eba\u6570\u636e\u3002<\/p>\n
SSL\uff08Secure Sockets Layer\uff09\u6216\u5176\u7ee7\u4efb\u8005TLS\uff08Transport Layer Security\uff09\u662f\u7528\u4e8e\u52a0\u5bc6\u4f20\u8f93\u7684\u534f\u8bae\uff0c\u7528\u4e8e\u4fdd\u62a4\u6570\u636e\u7684\u673a\u5bc6\u6027\u548c\u5b8c\u6574\u6027\u3002
\n\u9ad8\u901f\u7f13\u5b58\u901a\u5e38\u7528\u4e8e\u63d0\u9ad8Web\u9875\u9762\u7684\u52a0\u8f7d\u901f\u5ea6\uff0c\u4f46\u4e0d\u5e94\u7528\u4e8e\u5305\u542b\u654f\u611f\u4fe1\u606f\u7684SSL\u9875\u9762\u3002
\n\u5982\u679c\u67d0\u4e2aSSL\u9875\u9762\u88ab\u610f\u5916\u5730\u7f13\u5b58\u5728\u4ee3\u7406\u670d\u52a1\u5668\u3001CDN\uff08\u5185\u5bb9\u5206\u53d1\u7f51\u7edc\uff09\u6216\u6d4f\u89c8\u5668\u4e2d\uff0c\u53ef\u80fd\u4f1a\u5bfc\u81f4\u672a\u7ecf\u6388\u6743\u7684\u7528\u6237\u8bbf\u95ee\u654f\u611f\u6570\u636e\u3002
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u7981\u6b62SSL\u9875\u9762\u7684\u7f13\u5b58\uff1a \u786e\u4fdd\u60a8\u7684\u670d\u52a1\u5668\u914d\u7f6e\u6216\u7f51\u7ad9\u5e94\u7528\u7a0b\u5e8f\u4e2d\u5df2\u660e\u786e\u7981\u7528\u4e86SSL\u9875\u9762\u7684\u7f13\u5b58\u3002\u8fd9\u53ef\u4ee5\u901a\u8fc7HTTP\u5934\u4e2d\u7684Cache-Control\u548cPragma\u6307\u4ee4\u6765\u5b9e\u73b0\u3002\u5728HTTP\u54cd\u5e94\u5934\u4e2d\uff0c\u60a8\u53ef\u4ee5\u6dfb\u52a0\u4ee5\u4e0b\u6307\u4ee4\u6765\u544a\u8bc9\u6d4f\u89c8\u5668\u4e0d\u8981\u7f13\u5b58SSL\u9875\u9762\uff1a
\nCache-Control: no-store, no-cache, must-revalidate
\nPragma: no-cache
\n\u4f7f\u7528HTTP\u54cd\u5e94\u5934\u7684Strict-Transport-Security\uff08HSTS\uff09\uff1a HSTS\u5934\u544a\u8bc9\u6d4f\u89c8\u5668\u53ea\u80fd\u4f7f\u7528HTTPS\u8fde\u63a5\u8bbf\u95ee\u7f51\u7ad9\uff0c\u9632\u6b62HTTP\u8fde\u63a5\u7684\u4f7f\u7528\u3002\u8fd9\u6709\u52a9\u4e8e\u51cf\u5c11\u610f\u5916\u7684\u7f13\u5b58\u95ee\u9898\u3002\u5728HTTP\u54cd\u5e94\u5934\u4e2d\uff0c\u60a8\u53ef\u4ee5\u6dfb\u52a0\u4ee5\u4e0bHSTS\u5934\uff1a
\nStrict-Transport-Security: max-age=31536000; includeSubDomains; preload
\n#\u8fd9\u5c06\u544a\u8bc9\u6d4f\u89c8\u5668\u5728\u4e00\u5e74\u5185\u53ea\u4f7f\u7528HTTPS\u8fde\u63a5\u3002
\n\/\/\/
\nHTTP Strict Transport Security\uff08HSTS\uff09\u662f\u4e00\u4e2a\u5b89\u5168\u7b56\u7565\u5934\uff0c\u7528\u4e8e\u589e\u5f3aWeb\u5e94\u7528\u7a0b\u5e8f\u7684\u5b89\u5168\u6027\uff0c\u7279\u522b\u662f\u5728\u4f7f\u7528HTTPS\u65f6\u3002HSTS\u5934\u544a\u8bc9\u6d4f\u89c8\u5668\u53ea\u80fd\u4f7f\u7528HTTPS\u8fde\u63a5\u6765\u8bbf\u95ee\u7f51\u7ad9\uff0c\u4ee5\u9632\u6b62\u4e0d\u5b89\u5168\u7684HTTP\u8fde\u63a5\uff0c\u4ece\u800c\u51cf\u5c11\u4e2d\u95f4\u4eba\u653b\u51fb\u548c\u6570\u636e\u6cc4\u9732\u7684\u98ce\u9669\u3002\u4ee5\u4e0b\u662fHSTS\u5934\u4e2d\u7684\u4e00\u4e9b\u53c2\u6570\u53ca\u5176\u542b\u4e49\uff1a<\/p>\n
max-age\uff1a \u8fd9\u662fHSTS\u5934\u7684\u4e3b\u8981\u53c2\u6570\uff0c\u7528\u4e8e\u6307\u5b9a\u5ba2\u6237\u7aef\uff08\u6d4f\u89c8\u5668\uff09\u5e94\u8be5\u5728\u591a\u957f\u65f6\u95f4\u5185\u8bb0\u4f4f\u6b64\u7b56\u7565\u3002\u5b83\u7684\u503c\u662f\u4e00\u4e2a\u4ee5\u79d2\u4e3a\u5355\u4f4d\u7684\u6574\u6570\u3002\u4f8b\u5982\uff0cmax-age=31536000 \u8868\u793a\u5ba2\u6237\u7aef\u5e94\u8be5\u5728\u4e00\u5e74\u5185\u8bb0\u4f4fHSTS\u7b56\u7565\u3002\u8fd9\u6709\u52a9\u4e8e\u786e\u4fdd\u7f51\u7ad9\u957f\u671f\u4f7f\u7528HTTPS\u3002<\/p>\n
includeSubDomains\uff1a \u8fd9\u662f\u4e00\u4e2a\u53ef\u9009\u53c2\u6570\uff0c\u5982\u679c\u5305\u542b\u5728HSTS\u5934\u4e2d\uff0c\u5b83\u544a\u8bc9\u6d4f\u89c8\u5668\u5e94\u8be5\u5c06HSTS\u7b56\u7565\u5e94\u7528\u4e8e\u6240\u6709\u5b50\u57df\u540d\u3002\u4f8b\u5982\uff0cincludeSubDomains \u8868\u793a\u7b56\u7565\u5e94\u8be5\u5e94\u7528\u4e8e\u6240\u6709\u5b50\u57df\u540d\uff0c\u800c\u4e0d\u4ec5\u4ec5\u662f\u4e3b\u57df\u540d\u3002<\/p>\n
preload\uff1a \u8fd9\u4e5f\u662f\u4e00\u4e2a\u53ef\u9009\u53c2\u6570\uff0c\u5982\u679c\u5305\u542b\u5728HSTS\u5934\u4e2d\uff0c\u5b83\u8868\u793a\u7f51\u7ad9\u5e0c\u671b\u88ab\u9884\u52a0\u8f7d\u5230\u6d4f\u89c8\u5668\u7684HSTS\u5217\u8868\u4e2d\uff0c\u4ee5\u786e\u4fdd\u6d4f\u89c8\u5668\u59cb\u7ec8\u4f7f\u7528HTTPS\u8fde\u63a5\u3002\u7f51\u7ad9\u53ef\u4ee5\u5c06\u81ea\u5df1\u6dfb\u52a0\u5230HSTS\u9884\u52a0\u8f7d\u5217\u8868\uff0c\u5e76\u8981\u6c42\u6d4f\u89c8\u5668\u59cb\u7ec8\u4f7f\u7528HTTPS\u8fde\u63a5\u3002
\n\/\/\/
\nNginx\u914d\u7f6e\u793a\u4f8b\uff1a<\/p>\n
add_header Cache-Control no-store;<\/p>\n
add_header Pragma no-cache;
\n2.9 \u5728\u5e94\u7528\u7a0b\u5e8f\u4e2d\u53d1\u73b0\u4e0d\u5fc5\u8981\u7684 Http \u54cd\u5e94\u5934\uff08\u5177\u4f53\u4e8b\u4ef6\u5177\u4f53\u5206\u6790\uff09
\n1\u3001\u6982\u8ff0<\/p>\n
\u53d1\u73b0\u4e0d\u5fc5\u8981\u7684HTTP\u54cd\u5e94\u5934\u901a\u5e38\u6d89\u53ca\u5230\u5728\u5e94\u7528\u7a0b\u5e8f\u4e2d\u53d1\u9001\u4e86\u4e00\u4e9b\u4e0d\u5fc5\u8981\u6216\u6f5c\u5728\u7684\u5b89\u5168\u98ce\u9669\u7684\u5934\u4fe1\u606f\u3002\u8fd9\u4e9b\u5934\u4fe1\u606f\u53ef\u80fd\u5305\u542b\u654f\u611f\u4fe1\u606f\u6216\u53ef\u80fd\u5bfc\u81f4\u4e00\u4e9b\u5b89\u5168\u95ee\u9898\u3002<\/p>\n
HTTP\u54cd\u5e94\u5934\u5305\u542b\u4e86\u4e0e\u5ba2\u6237\u7aef\uff08\u6d4f\u89c8\u5668\uff09\u901a\u4fe1\u65f6\u4f20\u9012\u7684\u5143\u6570\u636e\u4fe1\u606f\u3002
\n\u4e0d\u5fc5\u8981\u7684\u54cd\u5e94\u5934\u53ef\u80fd\u4f1a\u6cc4\u9732\u6709\u5173\u670d\u52a1\u5668\u67b6\u6784\u3001\u5e94\u7528\u7a0b\u5e8f\u7248\u672c\u3001\u6280\u672f\u5806\u6808\u6216\u5176\u4ed6\u654f\u611f\u4fe1\u606f\uff0c\u8fd9\u4e9b\u4fe1\u606f\u53ef\u80fd\u88ab\u653b\u51fb\u8005\u6ee5\u7528\u3002
\n\u4e00\u4e9b\u4e0d\u5fc5\u8981\u7684\u54cd\u5e94\u5934\u4e5f\u53ef\u80fd\u5bfc\u81f4\u5b89\u5168\u6f0f\u6d1e\uff0c\u5982\u4e0d\u6b63\u786e\u7684CORS\uff08\u8de8\u6e90\u8d44\u6e90\u5171\u4eab\uff09\u914d\u7f6e\u6216\u7f3a\u5c11\u5b89\u5168\u7b56\u7565\u5934\u3002
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u5ba1\u67e5\u548c\u79fb\u9664\u4e0d\u5fc5\u8981\u7684\u54cd\u5e94\u5934\uff1a \u5b9a\u671f\u5ba1\u67e5\u60a8\u7684\u5e94\u7528\u7a0b\u5e8f\u7684HTTP\u54cd\u5e94\u5934\uff0c\u8bc6\u522b\u5e76\u79fb\u9664\u4e0d\u5fc5\u8981\u7684\u5934\u4fe1\u606f\u3002\u8fd9\u53ef\u80fd\u9700\u8981\u68c0\u67e5\u670d\u52a1\u5668\u914d\u7f6e\u3001Web\u6846\u67b6\u8bbe\u7f6e\u6216\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\u3002<\/p>\n
\u9690\u85cf\u670d\u52a1\u5668\u4fe1\u606f\uff1a \u5982\u679c\u54cd\u5e94\u5934\u4e2d\u5305\u542b\u4e86\u670d\u52a1\u5668\u7684\u8be6\u7ec6\u4fe1\u606f\uff0c\u60a8\u53ef\u4ee5\u8003\u8651\u9690\u85cf\u6216\u6a21\u7cca\u8fd9\u4e9b\u4fe1\u606f\uff0c\u4ee5\u51cf\u5c11\u653b\u51fb\u8005\u83b7\u53d6\u6709\u5173\u670d\u52a1\u5668\u7684\u4fe1\u606f\u7684\u53ef\u80fd\u6027\u3002\u8fd9\u53ef\u4ee5\u901a\u8fc7\u670d\u52a1\u5668\u914d\u7f6e\u6765\u5b9e\u73b0\u3002<\/p>\n
\u8bbe\u7f6e\u9002\u5f53\u7684CORS\u7b56\u7565\uff1a \u5982\u679c\u60a8\u7684\u5e94\u7528\u7a0b\u5e8f\u9700\u8981\u8de8\u6e90\u8d44\u6e90\u5171\u4eab\uff08CORS\uff09\uff0c\u786e\u4fdd\u914d\u7f6e\u9002\u5f53\u7684CORS\u7b56\u7565\u4ee5\u9650\u5236\u8de8\u6e90\u8bf7\u6c42\u3002\u4e0d\u6b63\u786e\u7684CORS\u914d\u7f6e\u53ef\u80fd\u4f1a\u5bfc\u81f4\u5b89\u5168\u95ee\u9898\u3002<\/p>\n
\u6dfb\u52a0\u5b89\u5168\u7b56\u7565\u5934\uff1a \u786e\u4fdd\u60a8\u7684\u5e94\u7528\u7a0b\u5e8f\u4e3a\u5b89\u5168\u6027\u6dfb\u52a0\u5fc5\u8981\u7684\u5934\u4fe1\u606f\uff0c\u5982X-Content-Type-Options\u3001X-Frame-Options\u3001Content-Security-Policy\u7b49\u3002\u8fd9\u4e9b\u5934\u4fe1\u606f\u6709\u52a9\u4e8e\u51cf\u5c11\u6f5c\u5728\u7684\u5b89\u5168\u6f0f\u6d1e\u3002<\/p>\n
\u9650\u5236\u654f\u611f\u4fe1\u606f\uff1a \u907f\u514d\u5728HTTP\u54cd\u5e94\u5934\u4e2d\u53d1\u9001\u654f\u611f\u4fe1\u606f\uff0c\u5982\u6570\u636e\u5e93\u9519\u8bef\u6d88\u606f\u3001\u8c03\u8bd5\u4fe1\u606f\u6216\u654f\u611f\u6587\u4ef6\u8def\u5f84\u3002\u786e\u4fdd\u4efb\u4f55\u6545\u969c\u4fe1\u606f\u90fd\u4ee5\u5b89\u5168\u7684\u65b9\u5f0f\u8bb0\u5f55\u6216\u62a5\u544a\uff0c\u800c\u4e0d\u4f1a\u6cc4\u9732\u7ed9\u7ec8\u7aef\u7528\u6237<\/p>\n
2.10 \u5f31\u5bc6\u7801\u5957\u4ef6 – ROBOT \u653b\u51fb: \u670d\u52a1\u5668\u652f\u6301\u6613\u53d7\u653b\u51fb\u7684\u5bc6\u7801\u5957\u4ef6
\n\u53c2\u71672.3 \uff0c\u4e3b\u8981\u539f\u56e0\u662f\u5b58\u5728\u5f31\u5bc6\u7801\u5957\u4ef6\uff0cnginx\u914d\u7f6e\u6587\u4ef6\u7684ssl_ciphers\u5c5e\u6027\u4e2d\u79fb\u9664\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u5957\u4ef6\u5373\u53ef<\/p>\n
2.11 \u68c0\u6d4b\u5230 SHA-1 \u5bc6\u7801\u5957\u4ef6
\n\u53c2\u71672.3 \uff0c\u4e3b\u8981\u539f\u56e0\u662f\u5b58\u5728\u5f31\u5bc6\u7801\u5957\u4ef6\uff0cnginx\u914d\u7f6e\u6587\u4ef6\u7684ssl_ciphers\u5c5e\u6027\u4e2d\u79fb\u9664\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u5957\u4ef6\u5373\u53ef<\/p>\n
2.12 \u68c0\u6d4b\u5230\u5f31\u5bc6\u7801: \u5e76\u975e\u6240\u6709\u5bc6\u7801\u5957\u4ef6\u5747\u652f\u6301\u5b8c\u5168\u524d\u5411\u4fdd\u5bc6
\n\u53c2\u71672.3 \uff0c\u4e3b\u8981\u539f\u56e0\u662f\u5b58\u5728\u5f31\u5bc6\u7801\u5957\u4ef6\uff0cnginx\u914d\u7f6e\u6587\u4ef6\u7684ssl_ciphers\u5c5e\u6027\u4e2d\u79fb\u9664\u4e0d\u5b89\u5168\u7684\u52a0\u5bc6\u5957\u4ef6\u5373\u53ef<\/p>\n
2.13 \u8fc7\u5ea6\u8bb8\u53ef\u7684 CORS \u8bbf\u95ee\u6d4b\u8bd5
\n1\u3001\u539f\u7406<\/p>\n
CORS\uff08\u8de8\u6e90\u8d44\u6e90\u5171\u4eab\uff09\u662f\u4e00\u79cd\u7528\u4e8eWeb\u5e94\u7528\u7a0b\u5e8f\u7684\u5b89\u5168\u673a\u5236\uff0c\u5b83\u63a7\u5236\u4e86\u6d4f\u89c8\u5668\u5982\u4f55\u5141\u8bb8\u6216\u62d2\u7edd\u4e0d\u540c\u6e90\uff08Origin\uff09\u4e4b\u95f4\u7684HTTP\u8bf7\u6c42\u3002\u53d1\u73b0\u8fc7\u5ea6\u8bb8\u53ef\u7684CORS\u8bbf\u95ee\u901a\u5e38\u6d89\u53ca\u5230\u5141\u8bb8\u4e0d\u5b89\u5168\u7684\u6216\u4e0d\u5fc5\u8981\u7684\u8de8\u6e90\u8bf7\u6c42\uff0c\u4ece\u800c\u53ef\u80fd\u5bfc\u81f4\u5b89\u5168\u6f0f\u6d1e\u3002<\/p>\n
CORS\u662f\u4e00\u79cd\u5b89\u5168\u673a\u5236\uff0c\u7528\u4e8e\u9632\u6b62\u8de8\u7ad9\u70b9\u8bf7\u6c42\u4f2a\u9020\uff08CSRF\uff09\u548c\u5176\u4ed6\u5b89\u5168\u95ee\u9898\u3002
\n\u8fc7\u5ea6\u8bb8\u53ef\u7684CORS\u8bbf\u95ee\u610f\u5473\u7740\u670d\u52a1\u5668\u5141\u8bb8\u6765\u81ea\u4e0d\u5b89\u5168\u6216\u4e0d\u4fe1\u4efb\u7684\u6e90\u7684\u8bf7\u6c42\uff0c\u53ef\u80fd\u5bfc\u81f4\u6076\u610f\u7f51\u7ad9\u8bbf\u95ee\u548c\u4fee\u6539\u7528\u6237\u6570\u636e\uff0c\u6216\u8fdb\u884c\u5176\u4ed6\u653b\u51fb\u3002
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u5ba1\u67e5\u548c\u9650\u5236CORS\u914d\u7f6e\uff1a \u5b9a\u671f\u5ba1\u67e5\u60a8\u7684\u5e94\u7528\u7a0b\u5e8f\u7684CORS\u914d\u7f6e\uff0c\u786e\u4fdd\u53ea\u5141\u8bb8\u6765\u81ea\u4fe1\u4efb\u7684\u6e90\u7684\u8bf7\u6c42\u3002\u60a8\u53ef\u4ee5\u901a\u8fc7\u914d\u7f6eCORS\u54cd\u5e94\u5934\u6765\u63a7\u5236\u54ea\u4e9b\u6e90\u53ef\u4ee5\u8bbf\u95ee\u60a8\u7684\u8d44\u6e90\u3002\u5728\u670d\u52a1\u5668\u7aef\u6216\u5e94\u7528\u7a0b\u5e8f\u4e2d\u8fdb\u884c\u914d\u7f6e\u3002<\/p>\n
\u4f7f\u7528\u9002\u5f53\u7684CORS\u5934\uff1a \u4f7f\u7528\u9002\u5f53\u7684CORS\u54cd\u5e94\u5934\uff0c\u5982 Access-Control-Allow-Origin\u3001Access-Control-Allow-Methods\u3001Access-Control-Allow-Headers \u548c Access-Control-Allow-Credentials\uff0c\u4ee5\u786e\u4fdd\u53ea\u6709\u7ecf\u8fc7\u6388\u6743\u7684\u8bf7\u6c42\u53ef\u4ee5\u6210\u529f\u8bbf\u95ee\u8d44\u6e90\u3002<\/p>\n
\u9a8c\u8bc1\u6765\u6e90\uff1a \u5728\u670d\u52a1\u5668\u7aef\u8fdb\u884c\u6e90\u9a8c\u8bc1\uff0c\u786e\u4fdd\u6765\u81ea\u4e0d\u5b89\u5168\u6216\u4e0d\u53d7\u4fe1\u4efb\u7684\u6e90\u7684\u8bf7\u6c42\u88ab\u62d2\u7edd\u3002\u8fd9\u53ef\u4ee5\u901a\u8fc7\u5728\u670d\u52a1\u5668\u7aef\u4ee3\u7801\u4e2d\u5b9e\u73b0\u6e90\u9a8c\u8bc1\u903b\u8f91\u6765\u5b8c\u6210\u3002<\/p>\n
\u9650\u5236HTTP\u65b9\u6cd5\u548c\u8bf7\u6c42\u5934\uff1a \u901a\u8fc7 Access-Control-Allow-Methods \u548c Access-Control-Allow-Headers \u5934\uff0c\u9650\u5236\u54ea\u4e9bHTTP\u65b9\u6cd5\u548c\u8bf7\u6c42\u5934\u5141\u8bb8\u8de8\u6e90\u8bf7\u6c42\u3002\u8fd9\u6709\u52a9\u4e8e\u51cf\u5c11\u6f5c\u5728\u7684\u5b89\u5168\u95ee\u9898\u3002<\/p>\n
\u4e0d\u4f7f\u7528\u901a\u914d\u7b26\uff1a \u907f\u514d\u4f7f\u7528\u901a\u914d\u7b26 * \u4f5c\u4e3a\u5141\u8bb8\u7684\u6e90\uff08Access-Control-Allow-Origin\uff09\u6216\u5141\u8bb8\u7684<\/p>\n
Nginx\u914d\u7f6e\u5b9e\u4f8b\uff1a<\/p>\n
add_header Access-Control-Allow-Origin: https:\/\/x.x.x.x
\n2.14 Cookie without HttpOnly flag set
\n1\u3001\u6982\u8ff0<\/p>\n
“Cookie without HttpOnly flag set\u901a\u5e38\u51fa\u73b0\u5728\u6d4f\u89c8\u5668\u7684\u5f00\u53d1\u8005\u5de5\u5177\u6216\u5b89\u5168\u6027\u626b\u63cf\u62a5\u544a\u4e2d\uff0c\u8868\u660e\u67d0\u4e9bHTTP Cookies\u672a\u8bbe\u7f6eHttpOnly\u6807\u5fd7\u3002HttpOnly\u6807\u5fd7\u662f\u4e00\u79cd\u5b89\u5168\u6027\u6807\u5fd7\uff0c\u7528\u4e8e\u9632\u6b62\u901a\u8fc7JavaScript\u8bbf\u95eeCookie\uff0c\u4ece\u800c\u51cf\u5c11\u8de8\u7ad9\u70b9\u811a\u672c\u653b\u51fb\uff08XSS\uff09\u7684\u98ce\u9669\u3002<\/p>\n
HTTP Cookies \u662f\u7528\u4e8e\u5728Web\u5e94\u7528\u7a0b\u5e8f\u548c\u6d4f\u89c8\u5668\u4e4b\u95f4\u5b58\u50a8\u4f1a\u8bdd\u4fe1\u606f\u548c\u5176\u4ed6\u6570\u636e\u7684\u673a\u5236\u3002
\n\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0cJavaScript\u53ef\u4ee5\u8bbf\u95ee\u5e76\u64cd\u4f5cCookie\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u5b89\u5168\u95ee\u9898\uff0c\u7279\u522b\u662f\u5728\u5b58\u5728XSS\u6f0f\u6d1e\u65f6\u3002
\n\u8bbe\u7f6eHttpOnly\u6807\u5fd7\u540e\uff0cCookie\u5c06\u4ec5\u4f9b\u670d\u52a1\u5668\u8bbf\u95ee\uff0c\u800c\u4e0d\u5141\u8bb8JavaScript\u4ee3\u7801\u8bbf\u95ee
\n2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u5728\u670d\u52a1\u5668\u7aef\u8bbe\u7f6eHttpOnly\u6807\u5fd7\uff1a \u786e\u4fdd\u5728\u670d\u52a1\u5668\u7aef\u4ee3\u7801\u4e2d\uff0c\u5f53\u521b\u5efa\u6216\u8bbe\u7f6eCookie\u65f6\uff0c\u5c06HttpOnly\u6807\u5fd7\u8bbe\u7f6e\u4e3aTrue\u3002\u4f8b\u5982\uff0c\u5728Python\u7684Django\u6846\u67b6\u4e2d\uff0c\u53ef\u4ee5\u4f7f\u7528\u5982\u4e0b\u65b9\u5f0f\u8bbe\u7f6e\uff1a
\nresponse.set_cookie(‘cookie_name’, ‘cookie_value’, httponly=True)
\n\u8fd9\u6837\u7684\u8bbe\u7f6e\u5c06\u786e\u4fddCookie\u5728\u6d4f\u89c8\u5668\u4e2d\u88ab\u6807\u8bb0\u4e3aHttpOnly\u3002<\/p>\n
\u6d4b\u8bd5\u548c\u9a8c\u8bc1\uff1a \u5728\u5e94\u7528\u7a0b\u5e8f\u4e0a\u7ebf\u540e\uff0c\u6d4b\u8bd5Cookie\u662f\u5426\u5df2\u6b63\u786e\u6807\u8bb0\u4e3aHttpOnly\u3002\u60a8\u53ef\u4ee5\u4f7f\u7528\u6d4f\u89c8\u5668\u7684\u5f00\u53d1\u8005\u5de5\u5177\u6765\u68c0\u67e5Cookie\u7684\u5c5e\u6027\u3002\u786e\u4fddJavaScript\u65e0\u6cd5\u8bbf\u95eeCookie\u3002
\nNginx\u914d\u7f6ehttponly\u6807\u5fd7\u793a\u4f8b
\nadd_header Set-Cookie \u201cPath=\/; HttpOnly; Secure\u201d;
\n2.15 SSH Weak Key Exchange Algorithms Enable
\n1\u3001\u6982\u8ff0<\/p>\n
“SSH Weak Key Exchange Algorithms Enabled” \u662f\u4e00\u4e2a\u5b89\u5168\u6027\u8b66\u544a\uff0c\u8868\u660eSSH\u670d\u52a1\u5668\u542f\u7528\u4e86\u5f31\u5bc6\u94a5\u4ea4\u6362\u7b97\u6cd5\uff0c\u8fd9\u53ef\u80fd\u5b58\u5728\u5b89\u5168\u98ce\u9669\u3002\u5f31\u5bc6\u94a5\u4ea4\u6362\u7b97\u6cd5\u53ef\u80fd\u5bb9\u6613\u53d7\u5230\u653b\u51fb\uff0c\u56e0\u6b64\u9700\u8981\u4fee\u590d\u4ee5\u63d0\u9ad8SSH\u670d\u52a1\u5668\u7684\u5b89\u5168\u6027\u3002<\/p>\n
SSH\u5bc6\u94a5\u4ea4\u6362\u7b97\u6cd5\u662f\u7528\u4e8e\u5efa\u7acb\u5b89\u5168SSH\u8fde\u63a5\u7684\u4e00\u90e8\u5206\uff0c\u5176\u4e2d\u5305\u62ec\u5bc6\u94a5\u534f\u5546\u548c\u5bc6\u94a5\u4ea4\u6362\u3002\u5f31\u5bc6\u94a5\u4ea4\u6362\u7b97\u6cd5\u901a\u5e38\u662f\u6307\u5b89\u5168\u6027\u8f83\u4f4e\u6216\u6613\u53d7\u653b\u51fb\u7684\u7b97\u6cd5\uff0c\u4f8b\u5982Diffie-Hellman Group1\uff08DH1\uff09\u6216Diffie-Hellman Group14\uff08DH14\uff09\u7b49\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u8fd9\u4e9b\u5f31\u5bc6\u94a5\u4ea4\u6362\u7b97\u6cd5\u53d1\u8d77\u653b\u51fb\uff0c\u5371\u53caSSH\u8fde\u63a5\u7684\u5b89\u5168\u6027\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
1\u3001\u67e5\u770b\u7cfb\u7edf\u652f\u6301\u7684\u7b97\u6cd5\uff1aman sshd_config |grep -A 40 -w KexAlgorithms
\n2\u3001\u6839\u636e\u7b2c\u4e00\u6b65\u67e5\u770b\u7684\u7ed3\u679c\u5217\u8868\uff0c\u53bb\u6389Diffie-Hellman\u7b97\u6cd5\uff0c\u5c06\u5176\u4f59\u7684\u7b97\u6cd5\u5199\u5165\u914d\u7f6e\u6587\u4ef6\uff1aecho “KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521” >> \/etc\/ssh\/sshd_config
\n3\u3001\u68c0\u6d4b\u914d\u7f6e\u5426\u6709\u95ee\u9898\uff1asshd -t
\n4\u3001\u91cd\u542f\uff1asystemctl restart sshd
\n5\u3001\u68c0\u67e5\u662f\u5426\u8fd8\u6709dh\u7b97\u6cd5\uff1asshd -T | grep -w kexalgorithms
\n2.16 SSH Server CBC Mode Ciphers Enabled
\n1\u3001\u6982\u8ff0<\/p>\n
“SSH Server CBC Mode Ciphers Enabled” \u662f\u4e00\u4e2a\u5b89\u5168\u6027\u8b66\u544a\uff0c\u8868\u660eSSH\u670d\u52a1\u5668\u542f\u7528\u4e86CBC\uff08Cipher Block Chaining\uff09\u6a21\u5f0f\u7684\u52a0\u5bc6\u7b97\u6cd5\u3002CBC\u6a21\u5f0f\u5728\u73b0\u4ee3SSH\u52a0\u5bc6\u4e2d\u88ab\u8ba4\u4e3a\u662f\u4e0d\u5b89\u5168\u7684\uff0c\u56e0\u4e3a\u5b83\u5bb9\u6613\u53d7\u5230\u653b\u51fb\uff0c\u7279\u522b\u662f\u9488\u5bf9\u5bc6\u7801\u5206\u6790\u548c\u6d41\u91cf\u5206\u6790\u7684\u653b\u51fb\u3002\u4fee\u590d\u8fd9\u4e2a\u95ee\u9898\u975e\u5e38\u91cd\u8981\uff0c\u4ee5\u63d0\u9ad8SSH\u670d\u52a1\u5668\u7684\u5b89\u5168\u6027<\/p>\n
CBC\u6a21\u5f0f\u662f\u4e00\u79cd\u5757\u52a0\u5bc6\u6a21\u5f0f\uff0c\u5b83\u4f9d\u8d56\u4e8e\u524d\u4e00\u4e2a\u52a0\u5bc6\u5757\u7684\u5bc6\u6587\u6765\u52a0\u5bc6\u5f53\u524d\u5757\u7684\u660e\u6587\uff0c\u56e0\u6b64\u5b58\u5728\u4ee5\u4e0b\u95ee\u9898\uff1a<\/p>\n
\u6d41\u91cf\u6a21\u5f0f\u653b\u51fb\uff08Traffic Analysis Attacks\uff09\uff1a \u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u5206\u6790\u52a0\u5bc6\u6d41\u91cf\u7684\u6a21\u5f0f\u6765\u63a8\u65ad\u51fa\u654f\u611f\u6570\u636e\u7684\u4fe1\u606f\uff0c\u8fd9\u5bf9\u5b89\u5168\u6027\u6784\u6210\u5a01\u80c1\u3002<\/p>\n
\u5bc6\u7801\u5206\u6790\uff08Cryptanalysis\uff09\uff1a \u5728\u7279\u5b9a\u6761\u4ef6\u4e0b\uff0cCBC\u6a21\u5f0f\u53ef\u80fd\u4f1a\u53d7\u5230\u5bc6\u7801\u5206\u6790\u653b\u51fb\uff0c\u4f8b\u5982\uff0c\u5982\u679c\u653b\u51fb\u8005\u80fd\u591f\u63a7\u5236\u6216\u89c2\u5bdf\u660e\u6587\u5757\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u767b\u5f55\u5230SSH\u670d\u52a1\u5668\uff1a \u4f7f\u7528\u5df2\u6709\u7684\u7ba1\u7406\u5458\u6216root\u6743\u9650\u7684\u5e10\u6237\u767b\u5f55\u5230SSH\u670d\u52a1\u5668\u3002<\/p>\n
\u7f16\u8f91SSH\u670d\u52a1\u5668\u914d\u7f6e\u6587\u4ef6\uff1a \u6253\u5f00SSH\u670d\u52a1\u5668\u7684\u914d\u7f6e\u6587\u4ef6\uff0c\u901a\u5e38\u662f\/etc\/ssh\/sshd_config\u3002<\/p>\n
\u7981\u7528CBC\u6a21\u5f0f\u52a0\u5bc6\uff1a \u5728\u914d\u7f6e\u6587\u4ef6\u4e2d\u627e\u5230\u5305\u542b\u52a0\u5bc6\u7b97\u6cd5\u7684\u90e8\u5206\uff0c\u5e76\u5220\u9664\u6216\u6ce8\u91ca\u6389CBC\u6a21\u5f0f\u76f8\u5173\u7684\u52a0\u5bc6\u7b97\u6cd5\u3002\u4f8b\u5982\uff1a<\/p>\n
# \u539f\u59cb\u914d\u7f6e\u4e2d\u7684\u793a\u4f8b
\nCiphers aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc<\/p>\n
# \u7981\u7528CBC\u6a21\u5f0f\u52a0\u5bc6\u7684\u793a\u4f8b\uff08\u4ec5\u4fdd\u7559CTR\u6a21\u5f0f\uff09
\nCiphers aes128-ctr,aes192-ctr,aes256-ctr
\n\u8bf7\u6839\u636e\u60a8\u7684\u914d\u7f6e\u6587\u4ef6\u4e2d\u7684\u5b9e\u9645\u5185\u5bb9\u8fdb\u884c\u4fee\u6539\u3002\u786e\u4fdd\u53ea\u4fdd\u7559CTR\uff08Counter\uff09\u6a21\u5f0f\u6216\u5176\u4ed6\u5b89\u5168\u7684\u52a0\u5bc6\u6a21\u5f0f\u3002<\/p>\n
\u4fdd\u5b58\u5e76\u9000\u51fa\uff1a \u4fdd\u5b58\u6240\u505a\u7684\u66f4\u6539\u5e76\u5173\u95ed\u914d\u7f6e\u6587\u4ef6\u3002<\/p>\n
\u91cd\u65b0\u52a0\u8f7dSSH\u670d\u52a1\u5668\uff1a \u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u91cd\u65b0\u52a0\u8f7dSSH\u670d\u52a1\u5668\u4ee5\u4f7f\u66f4\u6539\u751f\u6548\uff1a<\/p>\n
sudo service ssh restart # \u5728\u67d0\u4e9b\u7cfb\u7edf\u4e0a\u53ef\u80fd\u4f7f\u7528 systemctl restart sshd
\n\u6d4b\u8bd5\u8fde\u63a5\uff1a \u4f7f\u7528SSH\u5ba2\u6237\u7aef\u91cd\u65b0\u8fde\u63a5\u5230\u670d\u52a1\u5668\uff0c\u786e\u4fddSSH\u670d\u52a1\u5668\u4ecd\u7136\u53ef\u4ee5\u6b63\u5e38\u5de5\u4f5c\uff0c\u4f46\u4e0d\u518d\u4f7f\u7528CBC\u6a21\u5f0f\u52a0\u5bc6\u3002
\n2.17 X-Frame-Options Header Not Set
\n1\u3001\u6982\u8ff0<\/p>\n
“X-Frame-Options \u7f3a\u5931” \u662f\u4e00\u4e2a\u5b89\u5168\u6027\u8b66\u544a\uff0c\u901a\u5e38\u51fa\u73b0\u5728Web\u5e94\u7528\u7a0b\u5e8f\u7684HTTP\u54cd\u5e94\u5934\u4e2d\uff0c\u8868\u660e\u7f51\u7ad9\u6ca1\u6709\u8bbe\u7f6eX-Frame-Options\u6807\u5934\u3002\u8fd9\u4e2a\u6807\u5934\u7528\u4e8e\u63a7\u5236\u7f51\u7ad9\u662f\u5426\u53ef\u4ee5\u5728iframe\u6216frame\u4e2d\u5d4c\u5957\uff0c\u4ee5\u9632\u6b62\u70b9\u51fb\u52ab\u6301\uff08Clickjacking\uff09\u7b49\u653b\u51fb\u3002\u4fee\u590d\u8fd9\u4e2a\u95ee\u9898\u975e\u5e38\u91cd\u8981\uff0c\u4ee5\u589e\u52a0\u7f51\u7ad9\u7684\u5b89\u5168\u6027<\/p>\n
\u70b9\u51fb\u52ab\u6301\u662f\u4e00\u79cd\u653b\u51fb\u7c7b\u578b\uff0c\u653b\u51fb\u8005\u5c06\u53d7\u5bb3\u8005\u8bf1\u9a97\u5728\u4e00\u4e2a\u900f\u660e\u7684iframe\u6216frame\u4e2d\u70b9\u51fb\u4e00\u4e2a\u770b\u4f3c\u65e0\u5bb3\u7684\u9875\u9762\u5143\u7d20\uff0c\u5b9e\u9645\u4e0a\u662f\u5728\u4e0d\u77e5\u60c5\u7684\u60c5\u51b5\u4e0b\u6267\u884c\u4e86\u6076\u610f\u64cd\u4f5c\u3002\u4e3a\u4e86\u9632\u6b62\u8fd9\u79cd\u653b\u51fb\uff0c\u7f51\u7ad9\u53ef\u4ee5\u4f7f\u7528X-Frame-Options\u6807\u5934\u6765\u63a7\u5236\u662f\u5426\u5141\u8bb8\u7f51\u7ad9\u5728iframe\u6216frame\u4e2d\u5d4c\u5957\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u786e\u5b9a\u7b56\u7565\uff1a \u9996\u5148\uff0c\u786e\u5b9a\u60a8\u5e0c\u671b\u91c7\u7528\u7684\u7b56\u7565\uff0c\u4ee5\u51b3\u5b9a\u662f\u5426\u5141\u8bb8\u7f51\u7ad9\u5728iframe\u6216frame\u4e2d\u5d4c\u5957\u3002\u6709\u4e09\u79cd\u5e38\u89c1\u7684\u7b56\u7565\u53ef\u4f9b\u9009\u62e9\uff1a<\/p>\n
DENY\uff1a\u5b8c\u5168\u7981\u6b62\u7f51\u7ad9\u5728\u4efb\u4f55iframe\u6216frame\u4e2d\u5d4c\u5957\u3002
\nSAMEORIGIN\uff1a\u4ec5\u5141\u8bb8\u5728\u76f8\u540c\u57df\u540d\u7684iframe\u6216frame\u4e2d\u5d4c\u5957\u3002
\nALLOW-FROM uri\uff1a\u5141\u8bb8\u5728\u6307\u5b9aURI\u7684iframe\u6216frame\u4e2d\u5d4c\u5957\u3002
\n\u914d\u7f6e\u670d\u52a1\u5668\u6216\u5e94\u7528\u7a0b\u5e8f\uff1a \u6839\u636e\u60a8\u7684\u7b56\u7565\uff0c\u914d\u7f6eWeb\u670d\u52a1\u5668\uff08\u4f8b\u5982\uff0cNginx\u6216Apache\uff09\u6216Web\u5e94\u7528\u7a0b\u5e8f\u4ee5\u6dfb\u52a0X-Frame-Options\u6807\u5934\u5230HTTP\u54cd\u5e94\u4e2d\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u793a\u4f8b\uff1a<\/p>\n
\u4f7f\u7528Nginx\u6dfb\u52a0X-Frame-Options\u6807\u5934\uff1a<\/p>\n
add_header X-Frame-Options SAMEORIGIN;
\n2.18 X-Content-Type-Options Not set
\n1\u3001\u6982\u8ff0<\/p>\n
“X-Content-Type-Options \u7f3a\u5931” \u662f\u4e00\u4e2a\u5b89\u5168\u6027\u8b66\u544a\uff0c\u901a\u5e38\u51fa\u73b0\u5728Web\u5e94\u7528\u7a0b\u5e8f\u7684HTTP\u54cd\u5e94\u5934\u4e2d\uff0c\u8868\u660e\u7f51\u7ad9\u6ca1\u6709\u8bbe\u7f6eX-Content-Type-Options\u6807\u5934\u3002\u8fd9\u4e2a\u6807\u5934\u7528\u4e8e\u63a7\u5236\u6d4f\u89c8\u5668\u662f\u5426\u5e94\u8be5\u55c5\u63a2\uff08sniff\uff09\u54cd\u5e94\u4e2d\u7684\u5185\u5bb9\u7c7b\u578b\uff0c\u5e76\u9632\u6b62\u4e00\u4e9b\u6f5c\u5728\u7684\u5b89\u5168\u95ee\u9898\u3002\u4fee\u590d\u8fd9\u4e2a\u95ee\u9898\u6709\u52a9\u4e8e\u589e\u52a0\u7f51\u7ad9\u7684\u5b89\u5168\u6027\u3002<\/p>\n
\u6d4f\u89c8\u5668\u901a\u5e38\u4f1a\u5c1d\u8bd5\u55c5\u63a2\uff08sniff\uff09\u54cd\u5e94\u4e2d\u7684\u5185\u5bb9\u7c7b\u578b\uff0c\u5373\u4f7f\u670d\u52a1\u5668\u5df2\u7ecf\u660e\u786e\u6307\u5b9a\u4e86Content-Type\u5934\u3002\u8fd9\u79cd\u884c\u4e3a\u53ef\u80fd\u5bfc\u81f4\u4e00\u4e9b\u5b89\u5168\u95ee\u9898\uff0c\u4f8b\u5982MIME\u7c7b\u578b\u6df7\u6dc6\u653b\u51fb\u3002\u4e3a\u4e86\u9632\u6b62\u8fd9\u4e9b\u95ee\u9898\uff0c\u7f51\u7ad9\u53ef\u4ee5\u4f7f\u7528X-Content-Type-Options\u6807\u5934\uff0c\u5c06\u6d4f\u89c8\u5668\u7684\u55c5\u63a2\u884c\u4e3a\u5173\u95ed\uff0c\u5f3a\u5236\u4f7f\u7528\u670d\u52a1\u5668\u63d0\u4f9b\u7684Content-Type\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u8981\u4fee\u590d”X-Content-Type-Options \u7f3a\u5931”\u95ee\u9898\uff0c\u9700\u8981\u5728Web\u670d\u52a1\u5668\u6216Web\u5e94\u7528\u7a0b\u5e8f\u4e2d\u8bbe\u7f6eX-Content-Type-Options\u6807\u5934\u3002\u4e0b\u9762\u662f\u4fee\u590d\u7684\u4e00\u822c\u6b65\u9aa4\uff1a<\/p>\n
\u914d\u7f6e\u670d\u52a1\u5668\u6216\u5e94\u7528\u7a0b\u5e8f\uff1a \u5728Web\u670d\u52a1\u5668\uff08\u4f8b\u5982\uff0cNginx\u6216Apache\uff09\u6216Web\u5e94\u7528\u7a0b\u5e8f\u4e2d\u6dfb\u52a0X-Content-Type-Options\u6807\u5934\u5230HTTP\u54cd\u5e94\u4e2d\u3002\u8bbe\u7f6e\u6807\u5934\u7684\u503c\u4e3a nosniff\uff0c\u8868\u793a\u5173\u95ed\u6d4f\u89c8\u5668\u7684\u5185\u5bb9\u7c7b\u578b\u55c5\u63a2\u529f\u80fd\u3002
\n\u4f7f\u7528Nginx\u6dfb\u52a0X-Content-Type-Options\u6807\u5934\uff1a<\/p>\n
add_header X-Content-Type-Options “nosniff”;
\n2.19 X-Xss-Protection not set
\n1\u3001\u6982\u8ff0<\/p>\n
“X-XSS-Protection \u7f3a\u5931” \u662f\u4e00\u4e2a\u5b89\u5168\u6027\u8b66\u544a\uff0c\u901a\u5e38\u51fa\u73b0\u5728Web\u5e94\u7528\u7a0b\u5e8f\u7684HTTP\u54cd\u5e94\u5934\u4e2d\uff0c\u8868\u660e\u7f51\u7ad9\u6ca1\u6709\u8bbe\u7f6eX-XSS-Protection\u6807\u5934\u3002\u8fd9\u4e2a\u6807\u5934\u7528\u4e8e\u63a7\u5236\u6d4f\u89c8\u5668\u662f\u5426\u542f\u7528\u5185\u7f6e\u7684\u8de8\u7ad9\u811a\u672c\uff08XSS\uff09\u9632\u62a4\u673a\u5236\u3002\u4fee\u590d\u8fd9\u4e2a\u95ee\u9898\u6709\u52a9\u4e8e\u589e\u52a0\u7f51\u7ad9\u7684\u5b89\u5168\u6027\u3002<\/p>\n
\u8de8\u7ad9\u811a\u672c\uff08XSS\uff09\u653b\u51fb\u662f\u4e00\u79cd\u5e38\u89c1\u7684Web\u5b89\u5168\u95ee\u9898\uff0c\u653b\u51fb\u8005\u901a\u8fc7\u5728\u53d7\u5bb3\u8005\u7684\u6d4f\u89c8\u5668\u4e0a\u6267\u884c\u6076\u610f\u811a\u672c\u6765\u7a83\u53d6\u7528\u6237\u6570\u636e\u6216\u8fdb\u884c\u5176\u4ed6\u6076\u610f\u6d3b\u52a8\u3002\u4e3a\u4e86\u51cf\u8f7bXSS\u653b\u51fb\u7684\u98ce\u9669\uff0c\u73b0\u4ee3\u6d4f\u89c8\u5668\u63d0\u4f9b\u4e86\u5185\u7f6e\u7684XSS\u9632\u62a4\u673a\u5236\u3002X-XSS-Protection\u6807\u5934\u5141\u8bb8\u7f51\u7ad9\u63a7\u5236\u662f\u5426\u542f\u7528\u6d4f\u89c8\u5668\u7684XSS\u9632\u62a4\u529f\u80fd\u3002<\/p>\n
2\u3001 \u4fee\u590d\u63aa\u65bd<\/p>\n
\u8981\u4fee\u590d”X-XSS-Protection \u7f3a\u5931”\u95ee\u9898\uff0c\u9700\u8981\u5728Web\u670d\u52a1\u5668\u6216Web\u5e94\u7528\u7a0b\u5e8f\u4e2d\u8bbe\u7f6eX-XSS-Protection\u6807\u5934<\/p>\n
\u914d\u7f6e\u670d\u52a1\u5668\u6216\u5e94\u7528\u7a0b\u5e8f\uff1a \u5728Web\u670d\u52a1\u5668\uff08\u4f8b\u5982\uff0cNginx\u6216Apache\uff09\u6216Web\u5e94\u7528\u7a0b\u5e8f\u4e2d\u6dfb\u52a0X-XSS-Protection\u6807\u5934\u5230HTTP\u54cd\u5e94\u4e2d\u3002\u8bbe\u7f6e\u6807\u5934\u7684\u503c\u4e3a 1; mode=block\uff0c\u8868\u793a\u542f\u7528\u6d4f\u89c8\u5668\u7684XSS\u9632\u62a4\u529f\u80fd\u5e76\u4e14\u5728\u68c0\u6d4b\u5230XSS\u653b\u51fb\u65f6\u963b\u6b62\u9875\u9762\u52a0\u8f7d\u3002
\n\u4f7f\u7528Nginx\u6dfb\u52a0X-XSS-Protection\u6807\u5934\uff1a<\/p>\n
add_header X-XSS-Protection “1; mode=block”;<\/p>\n
\/*
\n\u5176\u4e2d1\u8868\u793a\u542f\u7528xss\u4fdd\u62a4\uff0c\u8fd9\u4e2a\u6570\u503c\u662f\u5fc5\u987b\u7684
\nmode\u53c2\u6570\uff0c\u53ef\u9009\uff0c\u6709\u4ee5\u4e0b\u503c\uff1a<\/p>\n
block\uff08\u9ed8\u8ba4\uff09\uff1a \u8fd9\u662f\u6700\u5e38\u89c1\u7684\u6a21\u5f0f\uff0c\u5b83\u8868\u793a\u5f53\u6d4f\u89c8\u5668\u68c0\u6d4b\u5230XSS\u653b\u51fb\u65f6\uff0c\u5c06\u963b\u6b62\u9875\u9762\u52a0\u8f7d\u3002\u8fd9\u662f\u4e00\u79cd\u5f3a\u5236\u6a21\u5f0f\uff0c\u5b83\u4e0d\u4ec5\u4f1a\u68c0\u6d4bXSS\u653b\u51fb\uff0c\u8fd8\u4f1a\u5c1d\u8bd5\u963b\u6b62\u5b83\u4eec\uff0c\u4ee5\u4fdd\u62a4\u7528\u6237<\/p>\n
report\uff1a\u8fd9\u4e2a\u6a21\u5f0f\u8868\u793a\u6d4f\u89c8\u5668\u5e94\u8be5\u68c0\u6d4b\u5230XSS\u653b\u51fb\u5e76\u62a5\u544a\u5b83\u4eec\uff0c\u4f46\u4e0d\u4f1a\u963b\u6b62\u9875\u9762\u52a0\u8f7d\u3002\u901a\u5e38\uff0c\u60a8\u9700\u8981\u6307\u5b9areport-uri\u53c2\u6570\uff0c\u4ee5\u4fbf\u6d4f\u89c8\u5668\u5c06\u62a5\u544a\u53d1\u9001\u5230\u6307\u5b9a\u7684URI\uff0c\u4ee5\u4f9b\u8fdb\u4e00\u6b65\u5206\u6790\u548c\u5904\u7406\u3002<\/p>\n
none\uff1a\u8fd9\u4e2a\u6a21\u5f0f\u8868\u793a\u7981\u7528XSS\u4fdd\u62a4\uff0c\u6d4f\u89c8\u5668\u5c06\u4e0d\u6267\u884cXSS\u68c0\u6d4b\u6216\u963b\u6b62\u3002\u8fd9\u901a\u5e38\u4e0d\u5efa\u8bae\u4f7f\u7528\uff0c\u56e0\u4e3a\u5b83\u4f1a\u964d\u4f4e\u5b89\u5168\u6027\u3002<\/p>\n
*\/<\/p>\n
2.20 CORS (Cross-Origin Resource Sharing) origin validation failure
\nps\uff1a\u7ed3\u5408 2.13<\/p>\n
1\u3001\u6982\u8ff0<\/p>\n
“CORS (Cross-Origin Resource Sharing) origin validation failure” \u662f\u4e00\u4e2aCORS\u5b89\u5168\u6027\u8b66\u544a\uff0c\u901a\u5e38\u51fa\u73b0\u5728Web\u5e94\u7528\u7a0b\u5e8f\u7684\u5f00\u53d1\u8fc7\u7a0b\u4e2d\uff0c\u8868\u660e\u6d4f\u89c8\u5668\u62d2\u7edd\u52a0\u8f7d\u6765\u81ea\u4e0d\u53d7\u4fe1\u4efb\u6216\u4e0d\u5141\u8bb8\u7684\u6765\u6e90\uff08origin\uff09\u7684\u8d44\u6e90\u3002\u8fd9\u4e2a\u8b66\u544a\u901a\u5e38\u7531CORS\u7b56\u7565\u4e0d\u6b63\u786e\u914d\u7f6e\u6216\u4e0d\u7b26\u5408\u9884\u671f\u5bfc\u81f4\u3002\u4fee\u590d\u8fd9\u4e2a\u95ee\u9898\u662f\u786e\u4fddWeb\u5e94\u7528\u7a0b\u5e8f\u80fd\u591f\u5b89\u5168\u5730\u4e0e\u5176\u4ed6\u6765\u6e90\u8fdb\u884c\u6570\u636e\u4ea4\u6362\u7684\u5173\u952e\u3002<\/p>\n
CORS\u662f\u4e00\u4e2a\u6d4f\u89c8\u5668\u5b89\u5168\u529f\u80fd\uff0c\u7528\u4e8e\u63a7\u5236\u5728Web\u9875\u9762\u4e0a\u7684JavaScript\u4ee3\u7801\u662f\u5426\u53ef\u4ee5\u4ece\u5176\u4ed6\u6e90\uff08origin\uff09\u52a0\u8f7d\u8d44\u6e90\uff0c\u4f8b\u5982\u4e0d\u540c\u57df\u7684API\u6216\u6587\u4ef6\u3002\u6d4f\u89c8\u5668\u6267\u884c\u4e00\u4e2a\u9884\u68c0\u67e5\u8bf7\u6c42\uff08Preflight Request\uff09\u6765\u9a8c\u8bc1\u662f\u5426\u5141\u8bb8\u8de8\u6e90\u8bf7\u6c42\u3002\u5982\u679c\u76ee\u6807\u670d\u52a1\u5668\u6ca1\u6709\u6b63\u786e\u914d\u7f6eCORS\u7b56\u7565\uff0c\u6d4f\u89c8\u5668\u5c06\u62d2\u7edd\u52a0\u8f7d\u6765\u81ea\u4e0d\u53d7\u4fe1\u4efb\u6765\u6e90\u7684\u8d44\u6e90\uff0c\u4ece\u800c\u89e6\u53d1 “CORS origin validation failure” \u8b66\u544a\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u8981\u4fee\u590d “CORS origin validation failure” \u95ee\u9898\uff0c\u9700\u8981\u6b63\u786e\u914d\u7f6eCORS\u7b56\u7565\u4ee5\u5141\u8bb8\u9884\u671f\u7684\u6765\u6e90\u6216\u57df\u52a0\u8f7d\u8d44\u6e90\u3002\u4ee5\u4e0b\u662f\u4fee\u590d\u7684\u4e00\u822c\u6b65\u9aa4\uff1a<\/p>\n
\u786e\u5b9a\u9884\u671f\u7684\u6765\u6e90\uff1a \u9996\u5148\uff0c\u786e\u5b9a\u54ea\u4e9b\u6765\u6e90\u6216\u57df\u5e94\u8be5\u88ab\u89c6\u4e3a\u53d7\u4fe1\u4efb\u7684\u6765\u6e90\u3002\u8fd9\u4e9b\u662f\u60a8\u5e0c\u671b\u5141\u8bb8\u8bbf\u95ee\u8d44\u6e90\u7684\u6765\u6e90\u3002<\/p>\n
\u914d\u7f6e\u670d\u52a1\u5668\u7aef\uff1a \u5728\u76ee\u6807\u670d\u52a1\u5668\u4e0a\uff0c\u914d\u7f6eCORS\u7b56\u7565\u4ee5\u5141\u8bb8\u9884\u671f\u7684\u6765\u6e90\u3002\u901a\u5e38\uff0c\u8fd9\u662f\u901a\u8fc7\u5728HTTP\u54cd\u5e94\u5934\u4e2d\u6dfb\u52a0\u4ee5\u4e0b\u6807\u5934\u6765\u5b8c\u6210\u7684\uff1a<\/p>\n
Access-Control-Allow-Origin\uff1a\u8bbe\u7f6e\u4e3a\u5141\u8bb8\u8bbf\u95ee\u8d44\u6e90\u7684\u6765\u6e90\uff08\u4f8b\u5982\uff0c* \u8868\u793a\u5141\u8bb8\u6240\u6709\u6765\u6e90\uff0c\u6216\u6307\u5b9a\u5141\u8bb8\u7684\u5177\u4f53\u6765\u6e90\uff09\u3002<\/p>\n
Access-Control-Allow-Methods\uff1a\u8bbe\u7f6e\u4e3a\u5141\u8bb8\u7684HTTP\u65b9\u6cd5\uff08\u4f8b\u5982\uff0cGET\u3001POST\u3001PUT\u3001DELETE\uff09\u3002<\/p>\n
Access-Control-Allow-Headers\uff1a\u8bbe\u7f6e\u4e3a\u5141\u8bb8\u7684\u8bf7\u6c42\u6807\u5934\u3002<\/p>\n
Access-Control-Allow-Credentials\uff1a\u5982\u679c\u9700\u8981\uff0c\u8bbe\u7f6e\u4e3atrue\u4ee5\u5141\u8bb8\u643a\u5e26\u51ed\u636e\u7684\u8bf7\u6c42\u3002<\/p>\n
Nginx\u914d\u7f6e\u5b9e\u4f8b\uff1a
\nlocation \/ {
\n# \u5141\u8bb8\u6240\u6709\u6765\u6e90\u8bbf\u95ee\u8d44\u6e90
\nadd_header ‘Access-Control-Allow-Origin’ ‘*’;<\/p>\n
# \u5141\u8bb8\u7684HTTP\u65b9\u6cd5
\nadd_header ‘Access-Control-Allow-Methods’ ‘GET, POST, OPTIONS’;<\/p>\n
# \u5141\u8bb8\u7684\u8bf7\u6c42\u6807\u5934
\nadd_header ‘Access-Control-Allow-Headers’ ‘Authorization’;<\/p>\n
# \u5141\u8bb8\u643a\u5e26\u51ed\u636e\u7684\u8bf7\u6c42\uff08\u5982\u679c\u9700\u8981\uff09
\nadd_header ‘Access-Control-Allow-Credentials’ ‘true’;
\n}<\/p>\n
\u914d\u7f6e\u5b8c\u6bd5\u8bb0\u5f97\u91cd\u65b0\u52a0\u8f7dnginx
\nsudo systemctl reload nginx<\/p>\n
2.21 TLS 1.0 enabled\uff08\u7248\u672c\u53ef\u53d8\u5316\uff09
\n1\u3001\u6982\u8ff0<\/p>\n
\u542f\u7528TLS 1.0\u901a\u5e38\u4e0d\u88ab\u8ba4\u4e3a\u662f\u4e00\u4e2a\u597d\u7684\u505a\u6cd5\uff0c\u56e0\u4e3aTLS 1.0\u5b58\u5728\u4e00\u4e9b\u5b89\u5168\u6027\u6f0f\u6d1e\u548c\u5f31\u70b9\uff0c\u5bb9\u6613\u53d7\u5230\u5404\u79cd\u653b\u51fb\u3002\u4e3a\u4e86\u63d0\u9ad8\u7f51\u7ad9\u7684\u5b89\u5168\u6027\uff0c\u901a\u5e38\u5efa\u8bae\u7981\u7528TLS 1.0\u5e76\u542f\u7528\u66f4\u73b0\u4ee3\u7684TLS\u534f\u8bae\u7248\u672c<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u5907\u4efd\u914d\u7f6e\u6587\u4ef6\uff1a \u5728\u8fdb\u884c\u4efb\u4f55\u66f4\u6539\u4e4b\u524d\uff0c\u8bf7\u786e\u4fdd\u5907\u4efd\u60a8\u7684Nginx\u914d\u7f6e\u6587\u4ef6\uff0c\u4ee5\u4fbf\u53ef\u4ee5\u5728\u9700\u8981\u65f6\u8fd8\u539f\u3002<\/p>\n
\u7f16\u8f91Nginx\u914d\u7f6e\u6587\u4ef6\uff1a \u6253\u5f00Nginx\u7684SSL\u914d\u7f6e\u6587\u4ef6\uff0c\u901a\u5e38\u662f \/etc\/nginx\/nginx.conf \u6216 \/etc\/nginx\/conf.d\/ssl.conf\uff0c\u5177\u4f53\u6587\u4ef6\u8def\u5f84\u53ef\u80fd\u56e0\u60a8\u7684\u914d\u7f6e\u800c\u5f02\u3002<\/p>\n
sudo nano \/etc\/nginx\/nginx.conf
\n\u6216<\/p>\n
sudo nano \/etc\/nginx\/conf.d\/ssl.conf
\n\u7981\u7528TLS 1.0\uff1a \u5728SSL\u914d\u7f6e\u5757\u4e2d\uff0c\u627e\u5230 ssl_protocols \u6307\u4ee4\uff0c\u5e76\u5c06\u5176\u8bbe\u7f6e\u4e3a\u53ea\u5141\u8bb8\u66f4\u5b89\u5168\u7684TLS\u7248\u672c\uff0c\u4f8b\u5982TLS 1.1\u3001TLS 1.2\u548c\/\u6216TLS 1.3\u3002\u5220\u9664\u6216\u6ce8\u91ca\u6389 SSLv3 \u548c TLSv1 \u90e8\u5206\uff0c\u4ee5\u7981\u7528TLS 1.0\u3002\u793a\u4f8b\u914d\u7f6e\u5982\u4e0b\uff1a<\/p>\n
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
\n\u8bf7\u6839\u636e\u60a8\u7684\u9700\u6c42\u81ea\u5b9a\u4e49TLS\u534f\u8bae\u7248\u672c\u3002<\/p>\n
\u4fdd\u5b58\u5e76\u9000\u51fa\uff1a \u4fdd\u5b58\u6240\u505a\u7684\u66f4\u6539\u5e76\u5173\u95ed\u914d\u7f6e\u6587\u4ef6\u3002<\/p>\n
\u6d4b\u8bd5\u914d\u7f6e\uff1a \u5728\u7ec8\u7aef\u4e2d\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u68c0\u67e5Nginx\u914d\u7f6e\u662f\u5426\u6709\u8bed\u6cd5\u9519\u8bef<\/p>\n
sudo nginx -t
\n\u5982\u679c\u6ca1\u6709\u9519\u8bef\uff0c\u60a8\u5c06\u770b\u5230 “Syntax OK” \u7684\u6d88\u606f\u3002<\/p>\n
\u91cd\u65b0\u52a0\u8f7dNginx\uff1a \u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u91cd\u65b0\u52a0\u8f7dNginx\u4ee5\u4f7f\u914d\u7f6e\u66f4\u6539\u751f\u6548\uff1a<\/p>\n
sudo systemctl reload nginx
\n2.22 Apache Cassandra Unauthorized Access Vulnerability
\n1\u3001\u6982\u8ff0<\/p>\n
“Apache Cassandra Unauthorized Access Vulnerability” \u662f\u4e00\u79cd\u5b89\u5168\u6f0f\u6d1e\uff0c\u53ef\u80fd\u4f1a\u5bfc\u81f4\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95eeApache Cassandra\u6570\u636e\u5e93\uff0c\u5141\u8bb8\u653b\u51fb\u8005\u83b7\u53d6\u654f\u611f\u6570\u636e\u6216\u6267\u884c\u6076\u610f\u64cd\u4f5c\u3002\u8fd9\u79cd\u6f0f\u6d1e\u7684\u5b58\u5728\u901a\u5e38\u662f\u7531\u4e8e\u9519\u8bef\u7684\u914d\u7f6e\u3001\u5f31\u5bc6\u7801\u6216\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\u5f15\u8d77\u7684\u3002\u4fee\u590d\u8fd9\u4e2a\u6f0f\u6d1e\u975e\u5e38\u5173\u952e\uff0c\u4ee5\u4fdd\u62a4\u6570\u636e\u5e93\u4e2d\u7684\u6570\u636e\u3002<\/p>\n
\u8fd9\u79cd\u6f0f\u6d1e\u901a\u5e38\u662f\u7531\u4e8e\u4ee5\u4e0b\u539f\u56e0\u4e4b\u4e00\u5f15\u8d77\u7684\uff1a<\/p>\n
\u5f31\u5bc6\u7801\uff1a \u5982\u679c\u6570\u636e\u5e93\u7528\u6237\u7684\u5bc6\u7801\u8fc7\u4e8e\u7b80\u5355\u6216\u5bb9\u6613\u731c\u6d4b\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u66b4\u529b\u7834\u89e3\u6216\u5b57\u5178\u653b\u51fb\u6765\u83b7\u5f97\u8bbf\u95ee\u6743\u9650\u3002<\/p>\n
\u8bbf\u95ee\u63a7\u5236\u4e0d\u5f53\uff1a \u672a\u6b63\u786e\u914d\u7f6e\u8bbf\u95ee\u63a7\u5236\u5217\u8868\uff08ACL\uff09\u6216\u6743\u9650\uff0c\u53ef\u80fd\u4f1a\u5141\u8bb8\u672a\u7ecf\u6388\u6743\u7684\u7528\u6237\u6216\u5ba2\u6237\u7aef\u8bbf\u95ee\u6570\u636e\u5e93\u3002<\/p>\n
\u9ed8\u8ba4\u914d\u7f6e\u4e0d\u5b89\u5168\uff1a \u5982\u679c\u60a8\u4f7f\u7528\u9ed8\u8ba4\u7684\u5b89\u5168\u914d\u7f6e\uff0c\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u5229\u7528\u5df2\u77e5\u7684\u9ed8\u8ba4\u51ed\u636e\u6765\u8bbf\u95ee\u6570\u636e\u5e93\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u5347\u7ea7\u548c\u7ef4\u62a4\uff1a \u786e\u4fdd\u60a8\u7684Apache Cassandra\u6570\u636e\u5e93\u662f\u6700\u65b0\u7248\u672c\uff0c\u5e76\u4e14\u5df2\u5e94\u7528\u6240\u6709\u5b89\u5168\u8865\u4e01\u3002\u5b9a\u671f\u7ef4\u62a4\u548c\u66f4\u65b0\u662f\u4fdd\u6301\u6570\u636e\u5e93\u5b89\u5168\u6027\u7684\u5173\u952e\u3002<\/p>\n
\u5f3a\u5bc6\u7801\u7b56\u7565\uff1a \u786e\u4fdd\u4e3a\u6570\u636e\u5e93\u7528\u6237\u914d\u7f6e\u5f3a\u5bc6\u7801\u7b56\u7565\uff0c\u8981\u6c42\u5bc6\u7801\u5177\u6709\u8db3\u591f\u7684\u590d\u6742\u6027\uff0c\u5305\u62ec\u5927\u5199\u5b57\u6bcd\u3001\u5c0f\u5199\u5b57\u6bcd\u3001\u6570\u5b57\u548c\u7279\u6b8a\u5b57\u7b26\uff0c\u5e76\u8bbe\u7f6e\u5bc6\u7801\u957f\u5ea6\u8981\u6c42\u3002\u6b64\u5916\uff0c\u8981\u6c42\u7528\u6237\u5b9a\u671f\u66f4\u6539\u5bc6\u7801\u3002<\/p>\n
\u8bbf\u95ee\u63a7\u5236\u5217\u8868\uff08ACL\uff09\uff1a \u901a\u8fc7\u6b63\u786e\u914d\u7f6e\u8bbf\u95ee\u63a7\u5236\u5217\u8868\uff08ACL\uff09\u6216\u6743\u9650\uff0c\u9650\u5236\u54ea\u4e9b\u7528\u6237\u6216\u5ba2\u6237\u7aef\u53ef\u4ee5\u8bbf\u95ee\u6570\u636e\u5e93\u3002\u53ea\u5141\u8bb8\u6388\u6743\u7528\u6237\u8bbf\u95ee\u6570\u636e\u5e93\u7684\u7279\u5b9a\u6570\u636e\u548c\u64cd\u4f5c\u3002<\/p>\n
\u7981\u7528\u9ed8\u8ba4\u51ed\u636e\uff1a \u7981\u7528\u9ed8\u8ba4\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u4e0d\u8981\u5728\u751f\u4ea7\u73af\u5883\u4e2d\u4f7f\u7528\u9ed8\u8ba4\u51ed\u636e\u3002\u786e\u4fdd\u60a8\u7684\u6570\u636e\u5e93\u7ba1\u7406\u5458\u548c\u7528\u6237\u90fd\u4f7f\u7528\u81ea\u5b9a\u4e49\u51ed\u636e\u3002<\/p>\n
2.23 Insecure Inline Frame (iframe)
\n1\u3001\u6982\u8ff0<\/p>\n
“Insecure Inline Frame (iframe)” \u6d89\u53ca\u5230\u5728\u7f51\u9875\u4e2d\u4f7f\u7528\u4e0d\u5b89\u5168\u7684 iframe \u5143\u7d20\u6765\u5d4c\u5165\u5176\u4ed6\u7f51\u9875\u6216\u8d44\u6e90\u3002\u8fd9\u79cd\u60c5\u51b5\u53ef\u80fd\u5bfc\u81f4\u4e00\u4e9b\u5b89\u5168\u95ee\u9898\uff0c\u56e0\u4e3a\u653b\u51fb\u8005\u53ef\u4ee5\u6ee5\u7528 iframe \u6765\u52a0\u8f7d\u6076\u610f\u5185\u5bb9\uff0c\u6267\u884c\u70b9\u51fb\u52ab\u6301\u653b\u51fb\uff0c\u6216\u7a83\u53d6\u7528\u6237\u7684\u654f\u611f\u4fe1\u606f\u3002<\/p>\n
iframe \u5143\u7d20\uff1a iframe \u662fHTML\u5143\u7d20\uff0c\u5141\u8bb8\u60a8\u5c06\u53e6\u4e00\u4e2a\u7f51\u9875\u5d4c\u5957\u5230\u5f53\u524d\u7f51\u9875\u4e2d\u3002\u901a\u8fc7 iframe\uff0c\u60a8\u53ef\u4ee5\u5728\u7f51\u9875\u4e2d\u663e\u793a\u6765\u81ea\u4e0d\u540c\u57df\u7684\u5185\u5bb9\u3002<\/p>\n
\u4e0d\u5b89\u5168\u6765\u6e90\uff1a \u5f53\u60a8\u5728 iframe \u4e2d\u5d4c\u5165\u6765\u81ea\u4e0d\u53d7\u4fe1\u4efb\u6216\u4e0d\u5b89\u5168\u7684\u6765\u6e90\u7684\u5185\u5bb9\u65f6\uff0c\u5b58\u5728\u6f5c\u5728\u7684\u5b89\u5168\u98ce\u9669\u3002\u8fd9\u4e9b\u6765\u6e90\u53ef\u80fd\u5305\u62ec\u672a\u53d7\u4fe1\u4efb\u7684\u7f51\u7ad9\u3001\u6076\u610f\u7ad9\u70b9\u6216\u672a\u7ecf\u9a8c\u8bc1\u7684\u8d44\u6e90\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u8981\u4fee\u590d”Insecure Inline Frame (iframe)”\u95ee\u9898\uff0c\u9700\u8981\u91c7\u53d6\u4ee5\u4e0b\u63aa\u65bd\u6765\u786e\u4fdd iframe \u7684\u5b89\u5168\u6027\uff1a
\n\u4ec5\u4ece\u53d7\u4fe1\u4efb\u7684\u6765\u6e90\u5d4c\u5165 iframe\uff1a \u53ea\u5141\u8bb8\u4ece\u53d7\u4fe1\u4efb\u7684\u3001\u5df2\u9a8c\u8bc1\u7684\u6765\u6e90\uff08\u57df\uff09\u5d4c\u5165 iframe\u3002\u8fd9\u53ef\u4ee5\u901a\u8fc7\u8bbe\u7f6e X-Frame-Options HTTP\u5934\u3001Content-Security-Policy\u5934\u6216 frame-ancestors \u7b49\u673a\u5236\u6765\u5b9e\u73b0\u3002<\/p>\n
\u542f\u7528\u5b89\u5168\u5934\uff1a \u5728HTTP\u54cd\u5e94\u5934\u4e2d\u8bbe\u7f6e X-Frame-Options \u4ee5\u6307\u5b9a\u662f\u5426\u5141\u8bb8\u5d4c\u5165 iframe\u3002\u5e38\u89c1\u9009\u9879\u5305\u62ec\uff1a<\/p>\n
DENY\uff1a\u4e0d\u5141\u8bb8\u4efb\u4f55\u7f51\u7ad9\u5d4c\u5165 iframe\u3002
\nSAMEORIGIN\uff1a\u53ea\u5141\u8bb8\u540c\u6e90\u7f51\u7ad9\u5d4c\u5165 iframe\u3002
\nALLOW-FROM uri\uff1a\u5141\u8bb8\u7279\u5b9a\u6765\u6e90\u7684\u7f51\u7ad9\u5d4c\u5165 iframe\u3002
\n\u793a\u4f8b\uff1a<\/p>\n
X-Frame-Options: SAMEORIGIN
\n\u4f7f\u7528 Content Security Policy (CSP)\uff1a \u914d\u7f6e CSP \u5934\u4ee5\u63a7\u5236\u7f51\u9875\u7684\u8d44\u6e90\u52a0\u8f7d\u548c iframe \u7684\u884c\u4e3a\u3002\u901a\u8fc7 CSP\uff0c\u60a8\u53ef\u4ee5\u9650\u5236\u4ece\u54ea\u4e9b\u6765\u6e90\u52a0\u8f7d iframe\u3002
\n\u793a\u4f8b\uff1a<\/p>\n
Content-Security-Policy: frame-ancestors ‘self’ example.com
\n\u786e\u4fdd iframe \u5185\u5bb9\u6765\u81ea\u53d7\u4fe1\u4efb\u7684 HTTPS \u6e90\uff1a \u5982\u679c\u60a8\u9700\u8981\u5d4c\u5165\u5176\u4ed6\u7f51\u9875\uff0c\u786e\u4fdd\u8fd9\u4e9b\u7f51\u9875\u4f7f\u7528\u5b89\u5168\u7684 HTTPS \u8fde\u63a5\u3002<\/p>\n
\u9632\u6b62\u70b9\u51fb\u52ab\u6301\u653b\u51fb\uff1a \u4f7f\u7528 frame-busting \u6280\u672f\u6216 X-Frame-Options \u6765\u9632\u6b62\u70b9\u51fb\u52ab\u6301\u653b\u51fb\u3002<\/p>\n
2.24 \u672a\u8bbe\u7f6eX-Permitted-Cross-Domain-Policies\u54cd\u5e94\u5934
\n1\u3001\u6982\u8ff0<\/p>\n
\u672a\u8bbe\u7f6e “X-Permitted-Cross-Domain-Policies” \u54cd\u5e94\u5934\u53ef\u80fd\u4f1a\u5bfc\u81f4\u8de8\u7ad9\u70b9\u8bf7\u6c42\u4f2a\u9020\uff08Cross-Site Request Forgery\uff0cCSRF\uff09\u7b49\u5b89\u5168\u98ce\u9669\u3002\u8fd9\u4e2a\u54cd\u5e94\u5934\u901a\u5e38\u7528\u4e8e\u6307\u5b9a\u8de8\u57df\u8bf7\u6c42\u7b56\u7565\uff0c\u4ee5\u63a7\u5236\u4e0d\u540c\u57df\u4e4b\u95f4\u7684\u8bf7\u6c42\u884c\u4e3a<\/p>\n
“X-Permitted-Cross-Domain-Policies” \u662f\u4e00\u4e2aHTTP\u54cd\u5e94\u5934\uff0c\u7528\u4e8e\u6307\u5b9a\u8de8\u57df\u8bf7\u6c42\u7b56\u7565\u3002\u5b83\u53ef\u4ee5\u6709\u4e0d\u540c\u7684\u7b56\u7565\u503c\uff0c\u63a7\u5236\u6d4f\u89c8\u5668\u5728\u8fdb\u884c\u8de8\u57df\u8bf7\u6c42\u65f6\u7684\u884c\u4e3a\u3002\u8fd9\u4e2a\u54cd\u5e94\u5934\u5bf9\u4e8e\u786e\u4fdd\u7f51\u7ad9\u7684\u5b89\u5168\u6027\u548c\u9632\u5fa1\u8de8\u7ad9\u70b9\u8bf7\u6c42\u4f2a\u9020\u653b\u51fb\u975e\u5e38\u91cd\u8981\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u8bbe\u7f6e\u54cd\u5e94\u5934\uff1a \u5728\u60a8\u7684Web\u670d\u52a1\u5668\u914d\u7f6e\u6216Web\u5e94\u7528\u7a0b\u5e8f\u4e2d\uff0c\u786e\u4fdd\u5728HTTP\u54cd\u5e94\u4e2d\u5305\u542b “X-Permitted-Cross-Domain-Policies” \u5934\uff0c\u5e76\u8bbe\u7f6e\u5408\u9002\u7684\u7b56\u7565\u503c\u3002
\nX-Permitted-Cross-Domain-Policies: none<\/p>\n
\/*
\nnone\uff1a \u8fd9\u662f\u6700\u4e25\u683c\u7684\u7b56\u7565\u503c\uff0c\u8868\u793a\u4e0d\u5141\u8bb8\u4efb\u4f55\u8de8\u57df\u8bf7\u6c42\u3002\u8fd9\u610f\u5473\u7740\u6d4f\u89c8\u5668\u4e0d\u4f1a\u5904\u7406\u4efb\u4f55\u6765\u81ea\u5176\u4ed6\u57df\u7684\u8bf7\u6c42\uff0c\u5373\u4f7f\u5b83\u4eec\u662f\u6709\u6548\u7684\u3002<\/p>\n
master-only\uff1a \u8fd9\u4e2a\u7b56\u7565\u503c\u8868\u793a\u53ea\u5141\u8bb8\u6765\u81ea\u4e3b\u57df\u7684\u8bf7\u6c42\u3002\u4e3b\u57df\u662f\u6307\u4e0e\u5f53\u524d\u7f51\u9875\u5b8c\u5168\u76f8\u540c\u7684\u57df\u3002<\/p>\n
by-content-type\uff1a \u8fd9\u4e2a\u7b56\u7565\u503c\u5141\u8bb8\u8de8\u57df\u8bf7\u6c42\uff0c\u4f46\u53ea\u6709\u5f53\u5185\u5bb9\u7c7b\u578b\uff08Content-Type\uff09\u4e0e\u5f53\u524d\u7f51\u9875\u76f8\u540c\u65f6\u624d\u4f1a\u88ab\u5141\u8bb8\u3002\u8fd9\u53ef\u4ee5\u7528\u4e8e\u67d0\u4e9b\u7279\u5b9a\u60c5\u51b5\u4e0b\u7684\u7075\u6d3b\u914d\u7f6e\u3002<\/p>\n
by-ftp-filename\uff1a \u8fd9\u4e2a\u7b56\u7565\u503c\u6307\u5b9a\u4e86\u53ea\u6709\u901a\u8fc7FTP\u4f20\u8f93\u7684\u8bf7\u6c42\u624d\u4f1a\u88ab\u5141\u8bb8\u3002\u8fd9\u901a\u5e38\u7528\u4e8e\u5904\u7406FTP\u670d\u52a1\u5668\u4e0a\u7684\u5185\u5bb9\u3002<\/p>\n
all\uff1a \u8fd9\u662f\u6700\u5bbd\u677e\u7684\u7b56\u7565\u503c\uff0c\u8868\u793a\u5141\u8bb8\u4efb\u4f55\u8de8\u57df\u8bf7\u6c42\u3002\u8fd9\u5c06\u5bfc\u81f4\u6d4f\u89c8\u5668\u5728\u5904\u7406\u8de8\u57df\u8bf7\u6c42\u65f6\u4e0d\u8fdb\u884c\u9650\u5236\u3002<\/p>\n
*\/
\nNginx\u914d\u7f6e\u793a\u4f8b\uff1a<\/p>\n
add_header X-Permitted-Cross-Domain-Policies “none”;
\n2.25 \u672a\u8bbe\u7f6eX-Download-Options\u54cd\u5e94\u5934
\n1\u3001\u6982\u8ff0<\/p>\n
\u672a\u8bbe\u7f6e “X-Download-Options” \u54cd\u5e94\u5934\u53ef\u80fd\u4f1a\u5bfc\u81f4\u5b89\u5168\u95ee\u9898\uff0c\u7279\u522b\u662f\u5728Internet Explorer\u6d4f\u89c8\u5668\u4e2d\u3002\u8fd9\u4e2a\u54cd\u5e94\u5934\u4e3b\u8981\u7528\u4e8e\u63a7\u5236\u5728IE\u6d4f\u89c8\u5668\u4e2d\u4e0b\u8f7d\u6587\u4ef6\u65f6\u7684\u884c\u4e3a\uff0c\u4ee5\u63d0\u9ad8\u6587\u4ef6\u4e0b\u8f7d\u7684\u5b89\u5168\u6027\u3002\u4ee5\u4e0b\u662f\u539f\u7406\u548c\u4fee\u590d\u65b9\u5f0f\uff1a<\/p>\n
“X-Download-Options” \u662f\u4e00\u4e2aHTTP\u54cd\u5e94\u5934\uff0c\u901a\u5e38\u7528\u4e8eInternet Explorer\u6d4f\u89c8\u5668\u3002\u5b83\u7684\u76ee\u7684\u662f\u63a7\u5236\u6d4f\u89c8\u5668\u662f\u5426\u5141\u8bb8\u6587\u4ef6\u4e0b\u8f7d\u548c\u6267\u884c\uff0c\u4ee5\u51cf\u5c11\u6f5c\u5728\u7684\u5b89\u5168\u98ce\u9669\u3002<\/p>\n
2\u3001\u4fee\u590d\u63aa\u65bd<\/p>\n
\u8981\u4fee\u590d\u672a\u8bbe\u7f6e “X-Download-Options” \u54cd\u5e94\u5934\u7684\u95ee\u9898\uff0c\u53ef\u4ee5\u91c7\u53d6\u4ee5\u4e0b\u63aa\u65bd\uff1a<\/p>\n
\u8bbe\u7f6e\u54cd\u5e94\u5934\uff1a \u5728\u60a8\u7684Web\u670d\u52a1\u5668\u914d\u7f6e\u6216Web\u5e94\u7528\u7a0b\u5e8f\u4e2d\uff0c\u786e\u4fdd\u5728HTTP\u54cd\u5e94\u4e2d\u5305\u542b “X-Download-Options” \u5934\uff0c\u5e76\u8bbe\u7f6e\u5408\u9002\u7684\u503c\u3002<\/p>\n
X-Download-Options: noopen
\n\u53ef\u7528\u7684\u7b56\u7565\u503c\u5305\u62ec\uff1a<\/p>\n
noopen\uff1a\u963b\u6b62IE\u6d4f\u89c8\u5668\u81ea\u52a8\u6253\u5f00\u4e0b\u8f7d\u7684\u6587\u4ef6\u3002
\nnosniff\uff1a\u9632\u6b62IE\u6d4f\u89c8\u5668\u5c1d\u8bd5\u6839\u636e\u5185\u5bb9\u7c7b\u578b\u6765\u89e3\u91ca\u6587\u4ef6\uff0c\u4ece\u800c\u9632\u6b62\u6f5c\u5728\u7684MIME\u7c7b\u578b\u6df7\u6dc6\u653b\u51fb\u3002
\nNginx\u914d\u7f6e\u793a\u4f8b\uff1a<\/p>\n
location \/ {
\nadd_header X-Download-Options “noopen”;
\n# \u5176\u4ed6\u914d\u7f6e\u9879…
\n}<\/p>\n
 <\/p>\n
https:\/\/www.cnblogs.com\/allay\/p\/17954392<\/p>\n","protected":false},"excerpt":{"rendered":"
\u9879\u76ee\u88ab\u626b\u51fa\u4e86\u6f0f\u6d1e\uff0c\u9700\u8981\u5b89\u5168\u52a0\u56fa\uff0c\u770b\u4e86\u4e0b\u5927\u90e8\u5206\u90fd\u662f\u548c\u8bf7\u6c42\u5934\u76f8\u5173…<\/p>\n","protected":false},"author":1,"featured_media":1059,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-1056","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nginx"],"_links":{"self":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1056","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1056"}],"version-history":[{"count":1,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1056\/revisions"}],"predecessor-version":[{"id":1060,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/posts\/1056\/revisions\/1060"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/media\/1059"}],"wp:attachment":[{"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1056"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1056"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.nonot.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1056"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}