Shinyproxy: OWASP/Security Checks

Created on 9 Sep 2020 · 3Comments · Source: openanalytics/shinyproxy

Hi there, an enterprise client is asking about an OWASP check for ShinyProxy - is there any detail you can give on checks you do or vulnerabilities that have been found and addressed?

question

Source

benkates

Most helpful comment

Thanks, we implemented the following and got no major risks from the pen test results:

server:
  frameOptions: SAMEORIGIN
  servlet:
    session:
      cookie:
        http-only: true
        secure: true

benkates on 20 Oct 2020

👍2

All 3 comments

Hi @benkates Some customers went through pentesting and formal audits of their ShinyProxy infrastructure. We have worked with them to include minor changes to make the software OWASP proof. In the release notes of version 2.3.1 you will notice a lot of small security enhancements that originate in this exercise: https://shinyproxy.io/downloads/

Hope this helps!

Best,
Tobias

tverbeke on 11 Sep 2020

👍2

Thanks, we implemented the following and got no major risks from the pen test results:

server:
  frameOptions: SAMEORIGIN
  servlet:
    session:
      cookie:
        http-only: true
        secure: true

benkates on 20 Oct 2020

👍2

Hi @benkates

We are now also using OWASP Dependency Check to make sure we use no dependencies with known vulnerabilities.
More information can be found on our website https://shinyproxy.io/documentation/security/#secure-dependencies

The next major release of ShinyProxy will update the Keycloak and Docker dependencies to the latest version.