Stott Security 4.0

[GeekInTheNorth]

v4.0

Key headline features include the ability to maintain your security.txt files and improved handling of nonce and hashes within the Content Security Policy.

This release is available on the following nuget feeds:

• https://nuget.optimizely.com
• https://www.nuget.org

Features

• Add support for security.txt #242
  • Added a new screen for managing security.txt files.
  • Security.txt content can be varied by site or by host and can even be simply global.
  • If a security.txt content cannot be resolved, a 404 will be returned instead.
  • Read more about security.txt files on the official security.txt website.
• Add ability to provide list of 'unsafe-hashes' #330
  • Added support for hashes as sources in the Content Security Policy, specific for SHA-256, SHA-384 and SHA-512.
  • Updated logic to be more deterministic of whether a request route is nonce or hash compatible or not.
    • This is achieved by defining a list of Nonce and Hash exclusion paths during the startup.cs in the AddStottSecurity(...) service extension method.
    • Any request whose path starts with one of the exclusion paths will have a CSP that does not contain a nonce, hash or the 'unsafe-hashes' keyword.
    • Default exclusion paths include:
      • /episerver
      • /ui
      • /util
      • /stott.robotshandler
      • /stott.security.optimizely
  • Thank you to @karolberezicki for requesting this change.
• Feature Request: Allow configuring nonce inclusion separately for script-src and style-src #316
  • The use of Nonce attributes to secure script and style tags has moved from the CSP Settings screen to CSP Sources
  • A new option appears on the Source Modal for 'nonce-random'
    • This will be converted to a secure random hash unique to a single request when headers are generated.
  • Existing Stott Security users will have their configuration safely migrated.
  • Export files created on version 3.x will have their data mapped accordingly when importing into 4.x
  • Thank you to @wpelczar for requesting this change.
• Rebuild the UI using Vite instead of Create-React-App #328
  • Originally the UI for this add-on was built using the "Create React App" methodology which is now defunct and unsupported.
  • Moving forward the UI is built using Vite for React.
  • All NPM dependencies have been updated.
• Add .NET 10 Support #323
  • Added a compilation target for .NET 10.
    • Compilation targets remain in place for .NET 6, .NET 8 and .NET 9
  • Unit Tests now execute as .NET 10.
  • Example project is now running as .NET 10.
• Add a fast add button for ContentDefinitionsAPI #271
  • Updated the "Add Content Delivery API Headers" on the CORS screen to be titled "Add Content Delivery/Definition API Headers"
  • Clicking this button will add the following headers to the "Expose Headers" configuration.
    • x-epi-contentguid
    • x-epi-branch
    • x-epi-siteid
    • x-epi-startpageguid
    • x-epi-remainingroute
    • x-epi-contextmode
    • x-epi-continuation

Bugs

• Update the HSTS Header so it is only served for HTTPS requests and not HTTP #318
  • The Strict-Transport-Security header will now only be included in HTTPS responses in alignment with best practices. See: MDN : Strict-Transport-Security header

Hotfix 4.0.1

• Audit tab has a missing filter option for security.txt #336
  • Added a missing entry to the Record Type filter for security.txt
  • Thank you to @SamuelJoseph23 for raising a PR to fix this bug.
• Security.txt files are being audited with the wrong operation names #341
  • Correct an issue where Operation Type for security.txt audit records was not consistent with other audit record types.

---

This discussion was created from the release Stott Security 4.0.

Help me celebrate this release with a coffee! ☕️