Security Checklist about blurts-server

[groovecoder]

@jvehent - Do we need to add greenkeeper, or are the GitHub Security Alerts for vulnerable dependencies good enough?

[g-k]

The github security alerts are good enough.

[pdehaan]

Semi-related, but we've been starting to use Renovate as an alternative to Greenkeeper in some projects lately, as it allows you to schedule when you want PRs [so your PR queue doesn't get flooded].

You can see a sample config in https://github.com/mozilla/watchdog-proxy/blob/master/renovate.json

[psiinon]

Note that in the latest checklist under

Security Features

We've added SameSite cookies:

• Session cookies must have HttpOnly and Secure flags set and the SameSite attribute set to 'strict' or 'lax' (which allows external regular links to login).

I'd update the first comment but it doesnt look like I have the right perms :)

[psiinon]

For Info the I've added the service to the daily baseline scan and the results (for those with the relevant perms) are here: https://github.com/mozilla-services/foxsec-results/blob/master/baseline-scan/Firefox-Monitor-Summary.md
Its currently failing on a missing anti CSRF token, which is probably and FP, but its also missing the SameSite flag on the session cookie, which would be really good to add.

[lesleyjanenorton]

hi @psiinon, can I get credentials to see the daily baseline scan results? thanks!

[psiinon]

Hi @lesleyjanenorton - you should have access to them now.
Let me know if you have any problems or questions.

[groovecoder]

Our latest baseline failures seem to be caused by the AWSELB cookie served with Secure and HttpOnly flags? @psiinon can you help us debug that or let us know if we can ignore those 2 fails?

[groovecoder]

@jvehent @psiinon - I have not started the process to add firefox.monitor.com to Firefox pre-loaded HPKP pins. I'm too afraid of HPKP suicide to start or rush it now. Is it okay to do that later?

[g-k]

@groovecoder if you're talking about the HPKP header, we dropped the recommendation for that from the checklist https://github.com/mozilla-services/foxsec/commit/12faf78319c2cd63161a973b45333b9eefb7ba22 (the wiki might not have been up to date when this bug was created)

Also, re: updating the baseline config for AWS LB cookies, Simon is on PTO and will be back next Wednesday.

[groovecoder]

Verified with ops that we're keeping logs for 90 days. Filed #464 for adding app-specific log codes.