Maintenance
Upgrading to V8
V8 Web Security
4 min
activate v7 and older were based on the assumption that access to the web portal was from a trusted network activate v7 and older used activate anywhere as an application proxy to implement internet facing security features activate v8 is based on the concept of 'zero trust security' this means that no one is trusted by default from inside or outside the network the main portal now implements security features that are normally seen on internet facing web sites these security features are based on current industry best practices default security features ssl/https only activate v8 is ssl only and allow communications must be over a secure ssl connection any connections to http are automatically redirected to https cookie security all cookies are marked with appropriate same site settings, secure and 'http only' settings content security policy the default content security policy prevents cross site scripting and loading of malicious content the default policy prevents the site being loaded into an iframe to protect against clickjacking style attacks the default policy also defines the minimum requirements for activate to operate removing existing default rights will break functionality the default content security policy can be changed at //resources/configuration/web/contentsecuritypolicy this guide may be useful if changing this https //cheatsheetseries owasp org/cheatsheets/content security policy cheat sheet html cross site scripting (xss) all content is encoded and checked for xss style attacks cross site request forgery (xsrf or csrf) a comprehensive cross site anti forgery mechanism based on net 6 is implemented by default https //learn microsoft com/en us/aspnet/core/security/anti request forgery?view=aspnetcore 6 0 this is required for forms and windows authentication default secure headers the following headers are added by default to all installations this provides industry best practice security https //infosec mozilla org/guidelines/web security#x frame options \<add name="x content type options" value="nosniff" /> \<add name="x frame options" value="deny" /> \<add name="x permitted cross domain policies" value="master only"/> \<add name="x xss protection" value="0"/> internet access activate anywhere is an application proxy and supported in v8 this has been rewritten to provide even high performance and security forms based authentication this generates an industry standard jwt token that is used to authenticate directly with the main activate portal ip based filtering and locking remote user password reset the main portal can be published directly to the internet (or via an application gateway), if authorization is done using azure oauth file upload security activate v8 will now verify that the contents of the file match the file extension for example, a user trying to upload an executable file by renaming it to zip would no longer work