aixlabDocs
GitHub Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. aixlabDocs
  2. /
  3. Implementations
  4. /
  5. Stop Tihange
  6. /
  7. Website

Website

3 minutes to read Website www

For Stop Tihange one website is in operation. The website is hosted at Cloudflare Pages. The website is active under the hostnames:

Content Management System

Cloudflare Pages hosts the website for www.stop-tihange.org. It is created with Hugo and version control is established on github and connected via CI/CD to cloudflare pages. The design is provided via the hugo theme Ananke. For the above named host establish:

stop-tihange.org/* > https://www.stop-tihange.org/$1
anti-akw-ac.de/* > https://www.anti-akw-ac.de/$1
*stop-tihange.eu/* > https://www.stop-tihange.org/$2

Custom Domain for staging environment

Follow the instruction Staging Domain for the domain staging.stop-tihange.org.

Authentication

Only he staging website ist protected by access management. Users are authenticated by getting a one-time pin via email. For that is not clear who will need to have access, protecting the site in this way, every email could be added to the One-time Pin Provider.

  • Add On-time PIN to staging following this documentation for staging environments:
    • *.stop-tihange-website.pages.dev and
    • staging.stop-tihange.org. All needed emails addresses need to be added to both.

TLS Configuration

The in Site configuration described security configurations should be set for the following domains:

  • stop-tihange.org
  • anti-akw-ac.de
  • stop-tihange.eu

Security Headers

Content Security Policy for inline CSS in Ananke Theme

Security header can’t be set in the demanded ranges of Secuirty Rules because the chosen template uses inline css. The following header needs to be modified:

  • Content-Security-Policy from default-src ‘self’; to default-src ‘self’; style-src ‘self’ ‘unsafe-inline’;.

Cloudflare file to set HTTP Security Headers

The headers can be activated by adding a file in the hugo folder static with the name _headers. The following headers will be set by the security configuration of cloudflare in each zone. The following header are set globally by cloudflare:

  • Strict-Transport-Security
  • X-Content-Type-Options

Problem when integrating web analytics direcly via page setup

If the integration of web analytics takes place directly via cloudflare pages, the script seems to be passed without the security-relevant hash in the integrity directive.

Sample code for the embedded java script code.

<script defer 
    src="https://static.cloudflareinsights.com/beacon.min.js/v52afc6f149f6479b8c77fa569edb01181681764108816" 
    integrity="sha512-jGCTpDpBAYDGNYR5ztKt4BQPGef1P0giN6ZGVUi835kFF88FOmmn8jBQWNgrNd8g/Yu421NdgWhwQoaOPFflDw==" 
    data-cf-beacon='{
        "rayId":"7d5acfd98825cadd",
        "version":"2023.4.0",
        "r":1,
        "token":"350831e1b3de440ba368ef1f0f760fdd","si":100}' 
        crossorigin="anonymous">
</script>

Content-Security-Policy Configuration for Web Analytics

If web analytics is activated, the domain static.cloudflareinsights.com must be added for scripts in the HTTP response header Content-Security-Policy:

Sample for the CSP

Content-Security-Policy: default-src ‘self’ static.cloudflareinsights.com;

Content-Security-Policy Configuration in total 

/*
 Content-Security-Policy: default-src 'self' static.cloudflareinsights.com; style-src 'self' 'unsafe-inline';
 X-Frame-Options: SAMEORIGIN
 X-XSS-Protection: 1; mode=block
 Access-Control-Allow-Origin : https://www.stop-tihange.org, https://www.anti-akw-ac.de
 Referrer-Policy: same-origin
 Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=(), conversion-measurement=(), focus-without-user-activation=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), sync-script=(), trust-token-redemption=(), window-placement=(), vertical-scroll=()
```