A line of defense for your Vapor application including attack filtering + extras.
Why use it?
Moat provides middleware, custom Leaf tags and string extensions to examine and block requests based on origin and referer headers, filter for src and href attribute XSS attacks, protecting unencoded HTML with esoteric XSS techniques, censoring profanity, and allowing for pure unchanged HTML.
Moat should be used alongside other protections such as CSRF tokens and a strong Content Security Policy (CSP) policy. A CSP policy gives directives to the browser to what and from where certain resources can be loaded from the page containing the CSP header. Please see the vapor-community/CSRF and brokenhandsio/VaporSecurityHeaders libraries to add CSRF tokens and security headers to your Vapor application.
For more information on Vapor application security please visit Broken Hands' Security And Your Vapor Application article.
Filters will be updated regularly to protect against the latest attacks.
Add Moat to your Package.swift
dependencies: [ ..., .package(url: "https://github.com/vapor-community/moat.git", from: "0.0.6") ]
Cross-Site Request Forgery (CSRF) Filters
The OriginCheckMiddleware helps protect against Cross-Site Request Forgery (CSRF) attacks by examining incoming Origin and/or Referer headers and blocking POST requests that do not come from a list of approved origins or referring pages. Origin and/or referer headers may not be present in all requests. You can choose to fail open, if origin or referrer headers are omitted, to balance security and functionality, or fail close if you require a higher level of security and/or no other CSRF mitigations are implemented in your application.
- Set origin and referer to the intended origin(s) and referer(s).
- Example origin:
- Example referer:
referer: "https://www.example.com/"(/ is important)
- Example origin:
- Decide if headers are not present to failopen or failclosed
- Set status to HTTPResponseStatus
- Set reason to error string
- origin: [String] or String
- referer: [String] or String
- failopen: Bool (default = True)
- status: HTTPResponseStatus (default = .badRequest)
- reason: String (default = "Origin check failed.")
If you would like you use the filtering on all POST requests, set up the OriginCheckMiddleware in your configure.swift file.
var middlewareConfig = MiddlewareConfig() let origins = ["https://www.example1.com", "https://www.example2.com"] let refers = ["https://www.example1.com/", "https://www.example2.com/"] middlewareConfig.use(OriginCheckMiddleware(origin: origins, referer: refers, failopen: true)) services.register(middlewareConfig)
If you would like the middleware applied to certain routes you can use route groups.
let origin = "https://www.example1.com" let referer = "https://www.example1.com/" let moat = router.grouped(OriginCheckMiddleware(origin: origin, referer: referer)) moat.post("...")
Cross-Site Scripting (XSS) Filters
Protects src or href attributes from XSS attacks. For example the payload
data:text/html;base64,PHNjcmlwdD5hbGVydCgnVmFwb3InKTwvc2NyaXB0Pg== are not escaped via templating engines or HTML encoding. These should be protected when embedded in src, href or data attributes (
Provides XSS protection to raw HTML strings whether via custom Leaf tag or strings. For example
<img src=x onerror="alert(1)"> becomes the safe
<img src=x ="alert(1)">
Note: Not all XSS attacks are mitigated as content is not HTML escaped.
Provides a customizable array to censor words or dictionary to replace words with alternatives. For example
Allows for raw unescaped, unfiltered and unprotected HTML to be passed to Leaf. For example the XSS exploit
<script>alert(1)</script> is unprotected and not HTML encoded or filtered.
- Use the
- Use the
- Use the
- Use the
Add Leaf tags to your configure.swift
var tags = LeafTagConfig.default() tags.use(ProfanityTag(), as: "clean") tags.use(SrcTag(), as: "src") tags.use(SrcTag(), as: "href") tags.use(HtmlTag(), as: "html") tags.use(ShrugTag(), as: "shrug") // ¯\_(ツ)_/¯ services.register(tags)
The Filter.swift contains a customizable list of filters:
HtmlEncodeFilter. They each contain an array (
filterArray) and a dictionary (
filterDict). Items in the array will be removed when filters, while the dictionary keys will be replaced with it's corresponding value.
Help us keep the lights on
0.0.6 - Jun 27, 2018
Added Origin and Referer header filtering for session-less CSRF mitigation.
0.0.5 - Jun 6, 2018
This release contains a patch to fix public declaration errors for custom Leaf tags.
0.0.4 - Jun 5, 2018
Package.Swift Updated for Leaf + Fixes
0.0.1 - Jun 2, 2018
Initial pre-release of Moat.