Securing your website with .htaccess - .htaccess HTTP Headers

HTTP Headers to Help Secure Your Website

Preventing cross-site request forgery (CSRF) attacks is hard and web applications must be built to prevent CSRF vulnerabilities. The first vulnerability is cross-site scripting (XSS).

Around 40.000 web sites have been catalogued by XSSed as being vulnerable to cross-site scripting (XSS). These attacks leave your users open to cookie theft, information theft, account hijacking, clickjacking and more.

Modern web browsers have some powerful protection build in nowadays but you need to tell the browser that you want those protection mechanisms used for your website. This can be archived by setting specific HTTP headers.

X-Frame-Options

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. This can be used to avoid clickjacking attacks, by ensuring that your content is not embedded into other sites.

This directive is pretty similar to the frame buster code explained in "Double Trouble on Google Images" except that it is only supported in the following browsers:

• Internet Explorer 8+
• Opera 10.50+
• Safari 4+
• Chrome 4.1.249.1042+
• Firefox 3.6.9+ (or earlier with NoScript)

There are three possible values for this header:

1. DENY - This setting prevents any pages served from being placed in a frame even if it is on the same website it originates from. should be used if you never intend for your pages to be used inside of a frame.
2. SAMEORIGIN - This setting allows pages to be served in a frame of a page on the same website. If an external site attempts to load the page in a frame the request will be denied.
3. ALLOW-FROM origin - If the value contains the token ALLOW-FROM origin, the browser will block rendering only if the origin of the top-level browsing context is different than the origin value supplied with the Allow-From directive.

The code below sets the directive to DENY, preventing our pages from being served in any frames, even from our own website.

0.# Don't allow any pages to be framed - Defends against CSRF

1.Header set X-Frame-Options DENY

Additional Reading:

• IE8 Security Part VII: ClickJacking Defenses
• Combating ClickJacking With X-Frame-Options

X-XSS-Protection

This header is exclusive to Internet Explorer 8 and 9, it turns on cross site scripting protection in IE 8 and IE 9 which is turned off by default as it could potentially break some websites. To turn on the XSS filter, use the header X-XSS-Protection "1; mode=block". If you wish to prevent this filter from being turned on for your website set the headers value to "0";

0.# Turn on IE8-IE9 XSS prevention tools

1.Header set X-XSS-Protection "1; mode=block"

X-Content-Security-Policy

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. This header is designed to specify how content interacts with your website.

Setting this directive to "allow 'self';" will prevent our pages from loading any external JavaScript or running any inline JavaScript. Our website will be safer from XSS attacks as it becomes more difficult for an attacker to run JavaScript in the visitor’s browser through a framed page on our website or through a SQL injection.

There are a lot of settings available for this header and I really urge you to read the Mozilla Wiki page before using CSP as you will have to allow certain external content if you run Google Adsense for example.

0.# Only allow JavaScript from the same domain to be run.

1.# Don't allow inline JavaScript to run.

2.Header set X-Content-Security-Policy "allow 'self';"

X-Content-Type-Options: nosniff

This header prevents "mime" based attacks. This header prevents Internet Explorer from MIME-sniffing a response away from the declared content-type as the header instructs the browser not to override the response content type. With the nosniff option, if the server says the content is text/html, the browser will render it as text/html.

view source

print?

0.# prevent mime based attacks

1.Header set X-Content-Type-Options "nosniff"

SimpleImage

Overview

This class makes image manipulation in PHP as simple as possible. The examples are the best way to learn how to use it, but here it is in a nutshell:

<?php

include('src/abeautifulsite/SimpleImage.php');

try {
    $img = new abeautifulsite\SimpleImage('image.jpg');
    $img->flip('x')->rotate(90)->best_fit(320, 200)->sepia()->save('example/result.gif');
} catch(Exception $e) {
    echo 'Error: ' . $e->getMessage();
}

?>

The two lines inside the try block load image.jpg, flip it horizontally, rotate it 90 degrees clockwise, shrink it to fit within a 320x200 box, apply a sepia effect, convert it to a GIF, and save it to result.gif.

With this class, you can effortlessly:

• Resize images (free resize, resize to width, resize to height, resize to fit)
• Crop images
• Flip/rotate/adjust orientation
• Adjust brightness & contrast
• Desaturate, colorize, pixelate, blur, etc.
• Overlay one image onto another (watermarking)
• Add text using a font of your choice
• Convert between GIF, JPEG, and PNG formats
• Strip EXIF data

Requirements

This class requires PHP 5.3 and PHP GD library.

Usage

Loading

You can load an image when you instantiate a new SimpleImage object:

$img = new abeautifulsite\SimpleImage('image.jpg');

Or you can create empty image 200x100 with black background:

$img = new abeautifulsite\SimpleImage(null, 200, 100, '#000');

Saving

Images must be saved after you manipulate them. To save your changes to the original file, simply call:

$img->save();

Alternatively, you can specify a new filename:

$img->save('new-image.jpg');

You can specify quality as a second parameter in percents within range 0-100

$img->save('new-image.jpg', 90);

Converting Between Formats

When saving, the resulting image format is determined by the file extension. For example, you can convert a JPEG to a GIF by doing this:

$img = new abeautifulsite\SimpleImage('image.jpg');
$img->save('image.gif');

Stripping EXIF data

There is no built-in method for stripping EXIF data, partly because there is currently no way to prevent EXIF data from being stripped using the GD library. However, you can easily strip EXIF data simply by loading and saving:

$img = new abeautifulsite\SimpleImage('image.jpg');
$img->save();

Method Chaining

SimpleImage supports method chaining, so you can make multiple changes and save the resulting image with just one line of code:

$img = new abeautifulsite\SimpleImage('image.jpg');
$img->flip('x')->rotate(90)->best_fit(320, 200)->desaturate()->invert()->save('result.jpg')

You can chain all of the methods below as well methods above.

Error Handling

SimpleImage throws exceptions when things don't work right. You should always load/manipulate/save images inside of atry/catch block to handle them properly:

try {
    $img = new abeautifulsite\SimpleImage('image.jpg');
    $img->flip('x')->save('flipped.jpg');
} catch(Exception $e) {
    echo 'Error: ' . $e->getMessage();
}

Method Examples

Most methods have intelligent defaults so you don't need to pass in every argument. Check out SimpleImage.class.php for required/optional parameters and valid ranges for certain arguments.

// Flip the image horizontally (use 'y' to flip vertically)
$img->flip('x');

// Rotate the image 90 degrees clockwise
$img->rotate(90);

// Adjust the orientation if needed (physically rotates/flips the image based on its EXIF 'Orientation' property)
$img->auto_orient();

// Resize the image to 320x200
$img->resize(320, 200);

// Trim the image and resize to exactly 100x75
$img->thumbnail(100, 75);

// Trim the image and resize to exactly 100x75, keeping the top* of the image
$img->thumbnail(100, 75, 'top');

// Shrink the image to the specified width while maintaining proportion (width)
$img->fit_to_width(320);

// Shrink the image to the specified height while maintaining proportion (height)
$img->fit_to_height(200);

// Shrink the image proportionally to fit inside a 500x500 box
$img->best_fit(500, 500);

// Crop a portion of the image from x1, y1 to x2, y2
$img->crop(100, 100, 400, 400);

// Fill image with white color
$img->fill('#fff');

// Desaturate (grayscale)
$img->desaturate();

// Invert
$img->invert();

// Adjust Brightness (-255 to 255)
$img->brightness(100);

// Adjust Contrast (-100 to 100)
$img->contrast(50);

// Colorize red at 50% opacity
$img->colorize('#FF0000', .5);

// Edges filter
$img->edges();

// Emboss filter
$img->emboss();

// Mean removal filter
$img->mean_remove();

// Selective blur (one pass)
$img->blur();

// Gaussian blur (two passes)
$img->blur('gaussian', 2);

// Sketch filter
$img->sketch();

// Smooth filter (-10 to 10)
$img->smooth(5);

// Pixelate using 8px blocks
$img->pixelate(8);

// Sepia effect (simulated)
$img->sepia();

// Change opacity
$img->opacity(.5);

// Overlay watermark.png at 50% opacity at the bottom-right of the image with a 10 pixel horizontal and vertical margin
$img->overlay('watermark.png', 'bottom right', .5, -10, -10);

// Add 32-point white text top-centered (plus 20px) on the image*
$img->text('Your Text', 'font.ttf', 32, '#FFFFFF', 'top', 0, 20);

// Add multiple colored text
$img->text('Your Text', 'font.ttf', 32, ['#FFFFFF' '#000000'], 'top', 0, 20);

• Valid positions are center, top, right, bottom, left, top left, top right, bottom left, bottom right

Utility Methods

The following methods are not chainable, because they return information about the image you're working with or output the image directly to the browser:

// Get info about the original image (before any changes were made)
//
// Returns:
//
//  array(
//      width => 320,
//      height => 200,
//      orientation => ['portrait', 'landscape', 'square'],
//      exif => array(...),
//      mime => ['image/jpeg', 'image/gif', 'image/png'],
//      format => ['jpeg', 'gif', 'png']
//  )
$info = $img->get_original_info();

// Get the current width
$width = $img->get_width();

// Get the current height
$height = $img->get_height();

// Get the current orientation (returns 'portrait', 'landscape', or 'square')
$orientation = $img->get_orientation();

// Flip the image and output it directly to the browser (i.e. without saving to file)
$img->flip('x')->output();

The SimpleImage Class for PHP

If you love working with PHP but hate the GD library, you'll love the Simple Image PHP class we're releasing today. This class takes the headache out of dealing with images and features over 25 useful methods.

The class is incredibly simple to use.  The following two lines will load image.jpg, flip it horizontally, rotate it 90 degrees, shrink it to fit within a 320x200 box, apply a sepia effect, convert it to a GIF, and save it to result.gif:

$img = new SimpleImage('image.jpg');
$img->flip('x')->rotate(90)->best_fit(320, 200)->sepia()->save('result.gif');

Here's a list of the supported methods:

• flip() - flips an image vertically or horizontally
• rotate() - rotates an image at the specified angle
• auto_orient() - adjusts the orientation based on the image's EXIF data
• resize() - resizes an image to the specified width/height
• fit_to_width() - proportionally resizes an image to the specified width
• fit_to_height() - proportionally resizes an image to the specified height
• best_fit() - proportionally resizes an image to fit within the specified width/height
• crop() - crop an image from x1/y1 to x2/y2
• square_crop() - trim the image to a square and resize to the specified size
• desaturate() - convert the image to grayscale
• invert() - invert the image
• brightness() - adjust the image's brightness
• contrast() - adjust the image's contrast
• colorize() - apply the colorize filter
• edges() - apply the edges filter
• emboss() - apply the emboss filter
• mean_remove() - apply the mean removal filter
• blur() - apply selective or gaussian blur to the image
• sketch() - apply the sketch filter
• smooth() - apply the smooth filter
• pixelate() - pixelate the image to blocks of the specified size
• sepia() - apply a simulated sepia effect
• overlay() - overlay one image onto another to create a watermark effect
• text() - Add text to the image