我想通過添加反跨站點腳本 (XSS) 安全措施來為我的網站增加更多安全性。
我正在嘗試在我的 .htaccess 檔案中設定標頭以包含所需的標頭以防止 XSS 和點擊劫持。
但是當我添加標題時，當我檢查我網站中的網路選項卡時，它們不會反映在我的網站中。
我還嘗試將標題添加到我的 header.php 檔案中，該檔案已包含在我網站的所有 .php 檔案中，但發送的標題并未發送或顯示在網路選項卡中。
這是我的代碼：
.htaccess 檔案：
RewriteEngine on
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-] $
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule !.*\.php$ %{REQUEST_FILENAME}.php [QSA,L]
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-] $
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{SERVER_PORT} 80
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
Options -Indexes
Header set X-XSS-Protection "1; mode=block"
Header append X-Frame-Options: "SAMEORIGIN"
Header set X-Content-Type-Options nosniff
# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php7_module>
php_flag display_errors Off
php_value max_execution_time 60
php_value max_input_time 60
php_value max_input_vars 1000
php_value memory_limit 256M
php_value post_max_size 32M
php_value session.gc_maxlifetime 1440
php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
php_value upload_max_filesize 64M
php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
php_flag display_errors Off
php_value max_execution_time 60
php_value max_input_time 60
php_value max_input_vars 1000
php_value memory_limit 256M
php_value post_max_size 32M
php_value session.gc_maxlifetime 1440
php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
php_value upload_max_filesize 64M
php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit
### If mod_rewrite is true...
<IfModule mod_rewrite.c>
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
### Prevent Apache from showing its server signature...
ServerSignature off
### Prevent phpinfo from showing details...
RewriteCond %{QUERY_STRING} =PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
RewriteRule .* - [F]
</IfModule>
# X-XSS-Protection
<IfModule mod_headers.c>
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
</IfModule>
# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php70” package as the default “PHP” programming language.
<IfModule mime_module>
AddHandler application/x-httpd-ea-php70 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
header.php 檔案：
<?php
// I included these headers at the top of my header.php file that is included everywhere in my website files.
header("X-XSS-Protection: 1; mode=block");
header("X-Frame-Options: SAMEORIGIN");
?>
uj5u.com熱心網友回復：
我發現問題出在那個headers are already being sent錯誤上，解決方法是在我的檔案開頭的 php 標記打開之前洗掉空格。
導致錯誤的先前代碼：
<?php
//my code
?>
洗掉空格解決了這個問題：
<?php
//my code
?>
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/451776.html