New security rule for SSL/https

Some additional security rules have been set up in the latest release of Impleo Web which should not have any impact on users, but which MAY have an impact for some.

If a solution runs SSL/https, an additional header will be added stating that the solution does not accept sources other than https. All attempts to include links/images/other resources from http (i.e. non-SSL) will be blocked.

It can, for example, be a link to external web fonts or images/pdfs located on external (or internal) websites. So customers who run https and link to images or other resources with http (without SSL) must therefore change this. This function is controlled from the configuration and is switched on by default if the site uses SSL. If your site uses iframes, external fonts etc., the setting must be turned off.

Technically, this is related to the headers:

Strict-Transport-Security; max-age=2592000

which means that you cannot link to http resources if you run SSL/https yourself.

X-Content-Type-Options; nosniff

which blocks the ability to make non-executable MIME types executable.

Referrer Policy; strict-origin

which blocks information about which URL it was linked from for external sites.

Permissions Policy; geolocation=(), microphone=()

which blocks the use of geolocation and microphone.

X-Frame-Options; DENY

which blocks the use of iframes.

Content-Security-Policy; default-src https: data: 'self' 'unsafe-inline' 'unsafe-eval'

which blocks Cross-Site-Scripting (XSS).