After running some security checks on my website with Detectify & Tinfoil, I'm faced with some concerns.

There seem to be a lot of security issues that I thought were covered by Drupal, and I'm unsure if I should be concerned with those or if there is a second layer of security that the scans are not checking.

The main vulnerabilities found by the scans are the following.

CSRF vulnerabilities

On /login, /user/password, and /user/register should not core security protect these pages? It seems like a big vulnerability for standard core pages. This even after the website is HTTPS Only, following the steps found here.

Exposed web.config and robot.txt

On root, is this something that I should obfuscate? I've found articles on files that should be removed from root (such as update.php) on a Drupal 8, but nothing on web.config and robot.txt protection.

TLS 1.0 Deprecated

Is there a way to change this?

XSS vulnerability/missing SRI (through Bootstraps cnd.jsdelivr/ 3rd party jquery CORS)

Is there a hook that can be implemented in this situation? Everything I tried so far has broken the website design, it seems that without going through Bootstraps CND Provider it misses the proper connections and i don't see a way to hash/secure Bootstraps' request.

I've seen quite a lot of documentation on Drupals' community about all these subjects, but (besides lot of content being for Drupal 7, which I'm not sure it applies for Drupal 8) I'm struggling to understand it.

Should I be worried of other possible vulnerabilities that the scan didn't flag?


This is not a complete answer to all of your questions, but I hope to take some of your concerns away.

  • CSRF protection for anonymous forms is not considered a vulnerability per this article. But that article recommends the seckit module for enforcing CSRF if you need it.

  • The use of TLS is a server setting, not related to Drupal.

  • robots.txt needs to be exposed to have crawlers detect it.

  • update.php is protected by the session by default (user has to be logged in to use it, though this can be turned off in settings.php).

All of the above should not be an issue.

The usage of web.config might be an issue (I am no windows server expert), but to my understanding it is at the same level as .htaccess for Apache. These files do not form a security issue per sé, but improper use of them can. web.conmfig files can for instance be used to store passwords for folder or database access. Drupal uses it to do some redirects and to prevent access to several folders and files. (No new info to your attacker since he already knew of those files because of the generator meta tag.)

So summarizing, Drupal might not always use best practices (though in a quick search, I did not find any info on what would be a better location for web.config), Drupal's focus is on maximizing compatibility and working out of the box, but that does not make it unsafe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.