CKFinder 2.x/Developers Guide/PHP/Configuration/Security/Securing a Publicly Accessible Folder - Revision history

P.Wiaderny at 10:50, 21 August 2019

2019-08-21T10:50:51Z

P.Wiaderny at 10:23, 21 August 2019

2019-08-21T10:23:20Z

P.Wiaderny: Created page with "When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to ma..."

2019-08-21T10:22:42Z

Created page with "When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to ma..."

New page

When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content. This requires to make the folder publicly accessible, so all the files are served through the web server. If you rely on your web server to serve the files uploaded with CKFinder, you should take additional steps to make sure the files are served in a secure way.

Let us assume that you have configured your CKFinder to allow uploading of avi files. Even if the avi file is then served with a valid Content-Type: <code>video/x-msvideo</code> header, some browsers may ignore this information and perform additional checks on the raw file contents. If any HTML-like data is detected in the file content, the browser may decide to ignore information about the content type and handle the served content as if it was a regular web page. This behavior is called [https://en.wikipedia.org/wiki/Content_sniffing content sniffing] (also known as ''media type sniffing'' or ''MIME sniffing''), and in some circumstances, it may lead to security issues (for example, it may open door for XSS attacks)).

To avoid content sniffing, you should make sure that your server adds the <code>X-Content-Type-Options: nosniff</code> header to all HTTP responses when serving files from the publicly available folder. The <code>X-Content-Type-Options</code> response HTTP header is a marker used by the server to indicate that the MIME type set by the <code>Content-Type</code> header should not be changed and should be followed. As a result, the browser does not perform any content sniffing on the received content.

'''Apache'''

If you use the Apache web server, you can add custom HTTP response headers using [https://httpd.apache.org/docs/current/mod/mod_headers.html mod_headers]. Make sure the <code>mod_headers</code> module is enabled, and create (or modify) the following <code>.htaccess</code> file in the root of the publicly accessible folder (for example <code>userfiles/.htaccess</code>):

<source lang="bash">
Header set X-Content-Type-Options "nosniff"
</source>

'''Nginx'''

If you use Nginx, custom HTTP response headers can be defined per location:

<source lang="bash">
location /userfiles {
add_header X-Content-Type-Options nosniff;
}
</source>

'''Microsoft IIS'''

For Microsoft IIS servers, you can enable the <code>X-Content-Type-Options</code> header in your <code>web.config</code> file:

<source lang="xml">
<system.webServer>
<httpProtocol>
<customHeaders>
<remove name="X-Content-Type-Options"/>
<add name="X-Content-Type-Options" value="nosniff"/>
</customHeaders>
</httpProtocol>
</system.webServer>
</source>

← Older revision		Revision as of 10:50, 21 August 2019
Line 1:		Line 1:
−	~~When integrating CKFinder, you will often want to give users access to uploaded files, so they can insert images or links to files into the edited content~~. This requires to make the folder publicly accessible, so all the files are served through the web server. If you rely on your web server to serve the files uploaded with CKFinder, you should take additional steps to make sure the files are served in a secure way.	+	{{Ckfinder_2.x Securing a Publicly Accessible Folder}}
−
−	~~Let us assume that you have configured your CKFinder to allow uploading of avi files. Even if the avi file is then served with a valid Content-Type: <code>video/~~x-msvideo</code> header, some browsers may ignore this information and perform additional checks on the raw file contents. If any HTML-like data is detected in the file content, the browser may decide to ignore information about the content type and handle the served content as if it was a regular web page. This behavior is called [https://en.wikipedia.org/wiki/Content_sniffing content sniffing] (also known as ''media type sniffing'' or ''MIME sniffing''), and in some circumstances, it may lead to security issues (for example, it may open door for XSS attacks)).
−
−	To avoid content sniffing, you should make sure that your server adds the <code>X-Content-Type-Options: nosniff</code> header to all HTTP responses when serving files from the publicly available folder. The <code>X-Content-Type-Options</code> response HTTP header is a marker used by the server to indicate that the MIME type set by the <code>Content-Type</code> header should not be changed and should be followed. As a result, the browser does not perform any content sniffing on the received content.

@@ Line 4: / Line 4: @@
 To avoid content sniffing, you should make sure that your server adds the <code>X-Content-Type-Options: nosniff</code> header to all HTTP responses when serving files from the publicly available folder. The <code>X-Content-Type-Options</code> response HTTP header is a marker used by the server to indicate that the MIME type set by the <code>Content-Type</code> header should not be changed and should be followed. As a result, the browser does not perform any content sniffing on the received content.
 '''Apache'''
@@ Line 12: / Line 13: @@
 Header set X-Content-Type-Options "nosniff"
 </source>
 '''Nginx'''