Adding security response headers with Amazon CloudFront

Boosting your sites security posture with improved response headers and Amazon CloudFront.

Background

Security response headers are HTTP headers that can be to improved the security posture of your web application and can mitigate attacks such as Cross-Site Scripting (XSS) which forms part of injection attacks in the OWASP Top 10 (number 3 at the time of writing this post).

Although this is a personal site, it’s been a while since I completed any updates so I wanted to baseline the config and then improve the security posture. This blog is fronted by Amazon CloudFront using Amazon S3 as an origin for the static content. This gives me a an opportunity to check out how easily CloudFront can help in adding controls

Benchmarking

I used Security Headers to scan the site. It’s a free, easy to use service where you stick in your site URL and it analyses the reponse headers before giving you a grading. Coincidently there was some news around Security Headers in June this year. It was created by Scott Helme, but is now part of Probely. Hopefully it continues to be maintained and basic services offered for free.

So, back to the scan, how back was it? Pretty bad, but that wasn’t really a surprise since apart from installing a certificate I’ve not focussed on the security previously. I got a resounding Fail (F)

What was more of a surprise was that with over 254 million sites scanned by Security Headers, 48% get a big fat F.

I’ve listed the missing headers below along with a brief description of each along with the OWASP recommended setting

Implementing Response Header Policies with Amazon CloudFront

Now that I’ve got a good understand of headers I can add to improve the security of my site, I can get started. Amazon CloudFront offers the ability to modify the HTTP headers sent to your Origin (in this case Amazon S3) and in the responses it sends back to browsers. This can be used to simplify Origin request such as removing non relevant headers, but it can also be used to insert security headers using CloudFront’s Response Headers Policies. The policy can then be attached to your CloudFront Distribution behavior.

Thankfully AWS provide some managed policies which you can use to easily get started.

The managed policies can be a quick way of adding some default response headers, although I recommend you pay close attention to the header values to ensure they are relevant to your site. Attaching the “SecurityHeadersPolicy” and a re-scan on the Security Headers site moved me from an F to a B so in the right direction, but not much use if it’s not suited for the use case.

In order to dive deeper and personalise the reponse I need to create a custom response headers policy. You can do this using the AWS Console, Infrastructure as Code (IaC) tool of choice (Amazon CloudFormation, Terraform etc) or using the AWS CLI/API. In this instance I’ll use the AWS CLI to obtain and create a new policy.

The Amazon CloudFront includes the CLI Skeleton to generate a YAML file for the config which I can then use as a template to modify and upload with your policy config:

aws cloudfront create-response-headers-policy --generate-cli-skeleton yaml-input > response-headers-policy.yaml

Opening the YAML file in your IDE of choice we can then modify it to add and remove headers as required. Here’s an example file using my config. **Note: AWS do not current support the Permissions-Policy header out of the box. I’ve added it here as a custom header:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

ResponseHeadersPolicyConfig:  
  Comment: 'implements security response headers'  
  Name: 'iceCandidate security reponse header policy' 
  SecurityHeadersConfig: 
    FrameOptions: 
      Override: true
      FrameOption: DENY 
    ReferrerPolicy: 
      Override: true  
      ReferrerPolicy: strict-origin-when-cross-origin 
    ContentTypeOptions: 
      Override: true  
    StrictTransportSecurity: 
      Override: true 
      IncludeSubdomains: true 
      Preload: true 
      AccessControlMaxAgeSec: 63072000 
  CustomHeadersConfig: 
    Quantity: 1
    Items: 
    - Header: 'Permissions-Policy'
      Value: 'geolocation=(), camera=(), microphone=()' 
      Override: true 

Note: I’ve not added a Content Security Policy as this needs to be done at a later date once I’ve understood which 3rd party dependencies I want to keep for this Hugo theme.

I can now upload my new response headers policy as a YAML file:

aws cloudfront create-response-headers-policy --cli-input-yaml file://response-headers-policy.yaml

The CLI response will provide a policy ID which I can then use to attach this new response headers policy to my CloudFront distribution. To do this I get the distribution config for my distribution ID and then update the ResponseHeadersPolicyId field to reflect my new policy ID along with updating the ETag field to IfMatch but without changing the value IfMatch: <ID>

aws cloudfront get-distribution-config --id distribution_ID --output yaml > dist-config.yaml

Then use the following command to update the distribution:

aws cloudfront update-distribution --id distribution_ID --cli-input-yaml file://dist-config.yaml

Final Steps

Now that the CloudFront distribution has been updated I can visit my site and use my browsers (Chrome) dev tools to ensure the response headers are updated when visiting the site.

A visit back to Security Headers and a re-scan moves the site to an A rating which will soon be improved further once a CSP is added.

Please let me know if this post has helped you or if you have any recommended updates.