Legal Robot · Report #149572
AWS S3 website can't serve security headers, may allow clickjacking
Validstatus
11upvotes
28 Sept 2016disclosed
Summary
Security researcher discovered that our AWS S3 website was not serving some basic security headers like X-Frame-Options. We resolved the issue by putting nginx in front of our AWS S3 website and adding header directives.
Fixed security headers can be verified here: https://schd.io/zt
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.