Add X-XSS-Protection HTTP Header for RASA Core server request- http://<hostname>:5005

Description of Problem:

This feature is needed to address cross site scripting security vulnerabilities and other headers as per need. https://forum.rasa.com/t/add-x-xss-protection-http-header-for-rasa-core-server-request-http-hostname-5005/20741?u=arunabh09

Overview of the Solution:

A possible solution which I have implemented is to modify the run.py file which uses sanic server implementation.

@app.middleware('response')
async def prevent_xss(request, response):
	response.headers["x-xss-protection"] = "1; mode=block"

In this way, you can add any other HTTP header as per security requirement. Examples (if relevant):

Reference: https://sanic.readthedocs.io/en/latest/sanic/middleware.html Blockers (if relevant): None

Definition of Done: Either enable critical security headers within RASA Core code (run.py) or configure an argument to easily enable/configure HTTP headers without the need for an end user to modify run.py file.

[wochinge]

The issue was reported by Qualys vulnerability scan tool which basically scans for all the open ports on the Linux server irrespective of exterior security configurations like firewall.

But what would the injected script do? Also the status endpoint is nothing which you would typically access with your browser (and only browsers process this headers).

Also, I did try using Apache reverse proxy settings as mentioned in the forum post, I was able to redirect 5005 request to 9090 Apache but 5005 was still open and the scan reports complained about missing XSS headers for 5005.

The reverse proxy settings can’t change the fact that your server exposes port 5005. I think the header is not the issue, but rather the fact that you should run a firewall.

[sara-tagger]

Thanks for submitting this feature request 🚀@wochinge will get back to you about it soon!✨