Chapter 10 — Application and software supply chain security: control configuration
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 The baseline"]
N2["10.2 Why headers matter for the supply chain"]
N3["Lab — header baseline"]
N4["10.3 Lab result"]
N5["10.4 Fixing safely"]
N6["10.5 Exceptions"]
N7["Applying through templates"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 The baseline"]
N2["10.2 Why headers matter for the supply chain"]
N3["Lab — header baseline"]
N4["10.3 Lab result"]
N5["10.4 Fixing safely"]
N6["10.5 Exceptions"]
N7["Applying through templates"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 The baseline]
|
v
[10.2 Why headers matter for the supply chain]
|
v
[Lab — header baseline]
|
v
[10.3 Lab result]
|
v
[10.4 Fixing safely]
|
v
[10.5 Exceptions]
|
v
[Applying through templates]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) configure a baseline of security headers and settings for customer sites; (2) check sites against it; (3) fix gaps safely; (4) record exceptions.
10.1 The baseline
Pinecrest's baseline for customer sites: HTTPS only with Strict-Transport-Security; a Content-Security-Policy limiting where scripts load from; X-Content-Type-Options set to nosniff; a Referrer-Policy; and no server header revealing software versions. OWASP ASVS 4.0.3 section V14 covers such configuration requirements. Each item has a specific job on a shop site. HSTS keeps browsers on HTTPS, CSP limits script sources, nosniff stops browsers guessing file types, Referrer-Policy limits what leaves in links, and hiding the version removes an easy clue for anyone scanning for old software.
10.2 Why headers matter for the supply chain
A Content-Security-Policy limits which outside sources a page will load scripts from. If a plugin is changed to load a script from an unknown domain, the browser blocks it. Headers do not replace verification, but they reduce what a changed component can do. For Ferncroft, the changed plugin sent visitors elsewhere through a redirect, which CSP does not stop, so verification remained essential there. Headers therefore work beside hash verification, each catching what the other misses on a hosted shop.
Lab — header baseline
"""Check synthetic site response headers against a baseline (stdlib only)."""
baseline = ["Strict-Transport-Security", "Content-Security-Policy", "X-Content-Type-Options", "Referrer-Policy"]
sites = {
"ferncroft-books": {"Strict-Transport-Security": "max-age=31536000", "Content-Security-Policy": "default-src 'self'",
"X-Content-Type-Options": "nosniff", "Referrer-Policy": "strict-origin-when-cross-origin"},
"alder-dental": {"Strict-Transport-Security": "max-age=31536000", "X-Content-Type-Options": "nosniff"},
"quayside-gym": {"Content-Security-Policy": "default-src 'self'", "X-Content-Type-Options": "nosniff",
"Referrer-Policy": "no-referrer", "Server": "webserver/2.4.29"},
}
for site, h in sites.items():
missing = [x for x in baseline if x not in h]
extra = ["Server header reveals version"] if "Server" in h and any(c.isdigit() for c in h["Server"]) else []
issues = [f"missing {m}" for m in missing] + extra
print(f"{site:16} {'OK' if not issues else '; '.join(issues)}")
Run with python3 lab_headers.py. Verified output:
ferncroft-books OK
alder-dental missing Content-Security-Policy; missing Referrer-Policy
quayside-gym missing Strict-Transport-Security; Server header reveals version
10.3 Lab result
ferncroft-books meets the baseline (OK). alder-dental is missing Content-Security-Policy and Referrer-Policy. quayside-gym is missing Strict-Transport-Security and its Server header reveals a version, webserver/2.4.29. ferncroft-books passing shows the baseline can be met on a real shop configuration. The other two sites fail for different reasons, so one generic fix would not do. alder-dental needs a policy written for its own scripts, while quayside-gym's gaps are fixed in the shared server template for all sites. The lab output becomes three tickets: two site-specific fixes and one template change.
10.4 Fixing safely
A new Content-Security-Policy can break pages that load scripts from legitimate outside services, such as a booking widget. Pinecrest first applies it in report-only mode, reviews reports for a week, adjusts, then enforces. Report-only mode lets the browser report what a policy would block without actually blocking it. For alder-dental, the week of reports showed one legitimate outside script, the appointment widget, whose domain was then added. Enforcing without this step could have broken bookings and turned the customer against the change.
10.5 Exceptions
If a customer needs a weaker setting, the reason and review date are recorded. An exception without a review date tends to become permanent and forgotten. Recording the reason lets a later technician judge whether it still applies, for example whether a customer still uses the outside service that needed a looser Content-Security-Policy. Expired exceptions go back to the baseline unless the customer renews the request with a reason. The exception record also names the customer contact who requested it, so renewal questions reach the right person at the right time.
Applying through templates
Headers are set in the shared server template, so fixes reach every site and new sites start compliant. Customer-specific additions live in a small override file reviewed by support.
Recording changes
Every baseline change is logged with its reason and date.
Worked example
Applying report-only mode to alder-dental shows one legitimate outside script, an appointment widget. Its domain is added, the policy enforced, and the site shows no errors. quayside-gym's missing header and version banner are fixed in the server template for all sites.
Synthetic case. Sites and headers are synthetic.
Errors and limits
Headers depend on browsers enforcing them; they are a layer, not a guarantee.
Exercises
- EX037 — Baseline items. List the baseline headers. Rubric: 3 = HSTS, CSP, nosniff, Referrer-Policy, no version banner; 2 = three; 1 = one; 0 = none.
- EX038 — Lab gaps. What did the lab find for alder-dental and quayside-gym? Rubric: 3 = alder missing CSP, Referrer; quayside missing HSTS, version banner; 2 = one; 1 = vague; 0 = none.
- EX039 — Report-only. Why use report-only mode first? Rubric: 3 = avoid breaking legitimate scripts; 2 = partial; 1 = vague; 0 = none.
- EX040 — CSP benefit. How does CSP help with supply chain problems? Rubric: 3 = blocks scripts from unknown domains; 2 = partial; 1 = vague; 0 = none.
Synthesis
Baselines limit what a changed component can do.
Continue studying — chapter 10 of 18
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →