Expected Behavior
The currently generated login and logout pages include 2 CSS from Bootstrap CDN. The first CSS (bootstrap.min.css) already includes an integrity attribute in the generated link. The second CSS (signing.css) does not include such attribute. However, according to https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity, sub resources elements loaded from a CDN using a link element should ideally include the integrity attribute. This could be reported as an issue by web security tools such as OWASP ZAP. Code impacted: https://github.com/spring-projects/spring-security/blob/f2f19270da063515cac5b9cb3a1612156715c009/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java#L81 https://github.com/spring-projects/spring-security/blob/f2f19270da063515cac5b9cb3a1612156715c009/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLogoutPageGeneratingFilter.java#L75 https://github.com/spring-projects/spring-security/blob/f2f19270da063515cac5b9cb3a1612156715c009/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java#L205 https://github.com/spring-projects/spring-security/blob/f2f19270da063515cac5b9cb3a1612156715c009/web/src/main/java/org/springframework/security/web/server/ui/LoginPageGeneratingWebFilter.java#L101
Current Behavior
This is the currently generated login page:
<title>Please sign in</title>
<link href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M" crossorigin="anonymous">
<link href="https://getbootstrap.com/docs/4.0/examples/signin/signin.css" rel="stylesheet" crossorigin="anonymous"/>
</head>
Context
Found this issue while running OWASP ZAP on my Spring Boot application, ZAP generated this alert:
Sub Resource Integrity Attribute Missing
Evidence: <link href="https://getbootstrap.com/docs/4.0/examples/signin/signin.css" rel="stylesheet" crossorigin="anonymous"/>
CWE: 345
WASC ID: 15
Source: Passive (90003 - Sub Resource Integrity Attribute Missing)
Comment From: sjohnr
@ovanekem thanks for reporting this. Generally, we recommend simply replacing the login and/or logout pages with your own, as they are not meant for production use. However, this seems a straightforward improvement.
Would you like to submit a PR for this?
Comment From: ovanekem
@sjohnr Yep sure, I'll fix and issue a PR.