Security

This page lists the current security policies enforced throughout our product.

Security headers

Security related headers are added to responses from both the Web (GUI) and API service. The following section describes the available security headers which are enabled by default in Exivity.

Content-Security-Policy

The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).

X-XSS-Protection

The X-XSS-Protection header is designed to enable the cross-site scripting (XSS) filter built into modern web browsers. This is usually enabled by default, but using it will enforce it.

Strict-Transport-Security

The Strict-Transport-Security header is a security enhancement that restricts web browsers to access web servers solely over HTTPS. This ensures the connection cannot be established through an insecure HTTP connection which could be susceptible to attacks.

X-Frame-Options

The X-Content-Type-Options header prevents Internet Explorer and Google Chrome from sniffing a response away from the declared Content-Type. This helps reduce the danger of drive-by downloads and helps treat the content the right way.

Feature-Policy

The Feature-Policy header grants the ability to allow or deny browser features, whether in its own frame or content within an inline frame element.

Referrer-Policy

The Referrer-Policy HTTP header controls how many referrers information (sent via the Referer header) should be included with requests. It is set to strict-origin, which Only sends the origin of the document as the referrer when the protocol security level stays the same (HTTPS → HTTPS), but don't send it to a less secure destination (HTTPS → HTTP).

API rate limiting

All API requests are rate limited to avoid overloading the server. Requests containing a user password in the payload are even further rate limited to mitigate brute-force attacks in user credentials.

User lockout

Users are denied new login attempts for a certain time interval when they use the wrong password several times.

Cross-Origin Resource Sharing (CORS)

Exivity by default only allows CORS requests to its API from the public instance domain. Additional CORS origins may be configured.

CSV injection mitigation

CSV cells should not begin with characters that might allow a CSV injection attach. Any exported data beginning with the following characters are prefixed with an apostrophe (', Unicode U+0027) to disable this:

• Equals Sign (=, Unicode U+003D)

• Plus Sign (+, Unicode U+002B)

• Hyphen-Minus (-, Unicode U+002D)

• Commercial At (@, Unicode U+0040)