realaravinth/debian-mirror-gitlab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
debian-mirror-gitlab/doc/development/new_fe_guide/development/security.md
Pirate Praveen dd13d6ff10 New upstream version 10.7.3+dfsg
2018-05-09 12:01:36 +05:30

901 B
Raw Blame History

Security

Avoid inline scripts and styles

Inline scripts and styles should be avoided in almost all cases. In an effort to protect users from XSS vulnerabilities, we will be disabling inline scripts using Content Security Policy.

Including external resources

External fonts, CSS, and JavaScript should never be used with the exception of Google Analytics and Piwik - and only when the instance has enabled it. Assets should always be hosted and served locally from the GitLab instance. Embedded resources via iframes should never be used except in certain circumstances such as with ReCaptcha, which cannot be used without an iframe.

Resources for security testing