Improve your site’s security using Lambda@Edge

In this post I’ll show you how I improved my site’s security using Lambda@Edge.

I recently went through my list of bookmarks again and stumbled upon https://securityheaders.com/, a website that scans a URL and gives it a rating based on the security headers that are set in the response.

So I gave it a try with my personal website:

Oops.

Let’s improve that.

In a previous post I already mentioned that I’m serving my blog using CloudFront and S3, which means I can easily add another Lambda@Edge function that add the required security headers to get this rating up.

The AWS documentation already gives quite a complete example on how to do this in Node.js, so I ported that to Python as that is what I use for the other Lambda@Edge function:

def handle_event(event, context):
    response = event["Records"][0]["cf"]["response"]
    headers = response["headers"]

    headers["strict-transport-security"] = [{
        "key": "Strict-Transport-Security",
        "value": "max-age=63072000; includeSubdomains; preload"
    }]
    headers["content-security-policy"] = [{
        "key": "Content-Security-Policy",
        "value": "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'"
    }]
    headers["x-content-type-options"] = [{
        "key": "X-Content-Type-Options",
        "value": "nosniff"
    }]
    headers["x-frame-options"] = [{
        "key": "X-Frame-Options",
        "value": "DENY"
    }]
    headers["x-xss-protection"] = [{
        "key": "X-XSS-Protection",
        "value": "1; mode=block"
    }]
    headers["referrer-policy"] = [{
        "key": "Referrer-Policy",
        "value": "no-referrer-when-downgrade"
    }]

    # If you remove the Server header in your code, CloudFront will still add its own header but it does not leak 
    # information about the backend server and does not give an attacker new information because they already know that 
    # they are connecting to a CloudFront IP address. <https://stackoverflow.com/a/58609507>
    if "server" in headers:
        del headers["server"]

    return response

I then configured it to trigger on the origin-response event in my serverless.yaml (see the previous post for the rest of the serverless.yaml):

functions:
  originResponse:
    handler: src/functions/origin_response/handler.handle_event
    events:
      - cloudFront:
          eventType: origin-response
          origin: http://${self:custom.domainName}.s3-website-eu-west-1.amazonaws.com

and deployed it.

After invalidating the cache I ran the check again:

Ok, getting somewhere!

I then fixed the error in the Strict-Transport-Security header (there’s a space in the value field in the example AWS gives) and added the following Permissions-Policy header.

headers["permissions-policy"] = [{
    "key": "Permissions-Policy",
    "value": "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), "
             "payment=(), usb=()"
}]

Again invalidated the cache and ran the test again:

🎉

That’s it, in about 30 minutes I went from an F to an A+ rating!

The creator of https://securityheaders.com/ has written about all the headers above, so in case you’d like to learn more about those I suggest you check out these posts:

• Hardening your HTTP response headers#Server
• HSTS - The missing link in Transport Layer Security
• Content Security Policy - An Introduction
• Hardening your HTTP response headers#X-Content-Type-Options
• Hardening your HTTP response headers#X-Frame-Options
• Content Security Policy - An Introduction
• A new security header: Referrer Policy
• Goodbye Feature Policy and hello Permissions Policy!

Other useful links

• HTTP headers on MDN Web Docs