Securing web page content
Methods and apparatus are described for automatically modifying web page source code to address a variety of security vulnerabilities such as, for example, vulnerabilities that are exploited by mixed content attacks.
1. A system comprising:
a memory; and
one or more physical processors coupled to the memory and configured to:
receiving a source code that is requested by a client device;
processing the source code to identify one or more security vulnerabilities including identification of an unsecure channel corresponding to a resource identified by the source code;
wherein processing the source code includes identifying a first reference in the source code to the resource to retrieve the resource via the unsecure channel;
determine whether one or more modifications to the source code would result in the resource being undeliverable to the client device;
modifying, responsive to processing the source code, the source code thereby generating a modified code, to access the resource via a secure channel;
wherein modifying the source code includes removing the first reference to the resource, adding a second reference to the resource specifying a security directive requiring use of the secure channel by a browser on the client device, and causing the resource to be hosted on a secure server or domain;
transmitting the modified code to the client device.
2. The system of claim 1 , wherein the source code was received from a server computer.
3. The system of claim 1 , wherein the one or more physical processors are further configured to:
receive one or more headers; and
modify a header among the one or more headers based on the security directive.
4. The system of claim 1 , wherein the one or more physical processors are further configured to determine that the client device supports communication via the secure channel.
5. The system of claim 1 , wherein modifying the source code causes the modified code to include identify an executable script in the source code.
6. The system of claim 1 , wherein modifying the source code causes the modified code to include an executable script.
7. The system of claim 1 , wherein modifying the source code includes specifying an X-Frame options header, or inserting frame-breaking code in the modified code.
8. The system of claim 1 , wherein the security directive is for use by the browser on the client device.
9. A method comprising:
receiving a source code that is requested by a client device;
processing the source code to identify one or more security vulnerabilities including identification of an unsecure channel corresponding to a resource identified by the source code;
wherein processing the source code includes identifying a first reference in the source code to the resource to retrieve the resource via the unsecure channel;
modifying, responsive to processing the source code, the source code thereby generating a modified code, to access the resource via a secure channel;
determining whether one or more modifications to the source code would result in the resource being undeliverable to the client device;
wherein modifying the source code includes removing the first reference to the resource, adding a second reference to the resource specifying a security directive requiring use of the secure channel by a browser on the client device, and causing the resource to be hosted on a secure server or domain;
executing the modified code on the client device;
wherein the method is performed by one or more physical processors.
10. The method of claim 9 further comprising requesting the resource via the secure channel.
11. The method of claim 9 further comprising sending a request, to a server computer, based on the security directive.
12. The method of claim 9 further comprising determining that the client device supports communication via the secure channel.
13. The method of claim 9 , wherein modifying the source code causes the modified code to include identify an executable script in the source code.
14. The method of claim 9 , wherein modifying the source code causes the modified code to include an executable script.
15. The method of claim 9 further comprising specifying an X-Frame options header, or inserting frame-breaking code in the modified code.
16. The method of claim 9 , wherein the security directive is for use by the browser on the client device.