From time to time, Vaadin users perform security tests on the framework and report issues they find. Most of the time the issues are false positives. In the following is a list of commonly reported false positives and why they are false.
script-src 'unsafe-inline' 'unsafe-eval' and
As such, these settings are architectural limitations in Vaadin so that the framework can start its client side engine in the browser.
Reported as: Missing or insecure “Content-Security-Policy” header
These values are not used as CSRF tokens, and they are not processed in a way that would let an attacker compromise the application state.
Vaadin uses its own CSRF scheme, see above.
Cross-Site Request Forgery (CSRF) when fetching static resources
Many tools report a CSRF vulnerability when Vaadin fetches static resources. These requests can not change app state. Here is a list of resources that are safe to fetch without a CSRF token:
Widgetset files (such as
Reported as: Authentication Bypass Using HTTP Verb Tampering
Some tools mark downloading the vaadinBootstrap.js file as an issue; this file is a required part of starting the application, and is a static resource.
Some tools that check for this do not check the content of the response, only the response status. Vaadin does not send server log files to the client, even though the response status is set to 200.
This issue is reported because
vaadinBootstrap.js indeed opens a new HTTP request. This is done to fetch the initial application state (on first request to an app URL, Vaadin replies with the bootstrap file; that in turn loads the theme, widgetset, and app state).
The way this request is done can not be used by an attacker to modify the application state, hence this is a false positive.
The X-Frame-Options are a way for web pages or apps to tell the browser that they should not be run inside frames (inside another page). This is done to try to ensure that these sites are not wrapped in malicious pages where attackers can intercept user actions.
Vaadin does not automatically set the
X-Frame-Options HTTP header, because many times apps should run inside frames. Developers can set this header either in their server options or by using the Java Servlet API (using e.g. the Vaadin BootstrapListener or creating a Servlet Filter).