spring-cloud/spring-cloud-gateway

Provide an easy method to disable all secure-headers

Open

Aperta il 20 apr 2023

Vedi su GitHub
 (1 commento) (0 reazioni) (0 assegnatari)Java (4284 star) (3204 fork)batch import
enhancementhelp wanted

Descrizione

Is your feature request related to a problem? Please describe. Some users want to disable all secure-headers, but the current method requires listing all headers one by one, which is not trivial and not complete in case that in some future a new header is added. Even if that possibility is remote.

Describe the solution you'd like I'd like to be able to disable all in a concise way, my proposal is to provide an all flag like.

spring.cloud.gateway.filter.secure-headers.disable=all

This should not overlap with any other secure header, or just to be sure and make uses well aware of the implications, we could use all-headers.

Describe alternatives you've considered The feature is already possible, as exposed, this is a matter of convenience and future-proof.

Additional context n/a

Guida contributor

Tech stack
java
Dominio
backendsecurity
Tipo issue
feature
DifficoltàQuanto dovrebbe essere impegnativa per un nuovo contributor.
3
Tempo stimatoTempo stimato per completare e verificare uno scope piccolo.
1-3 hours
Stato attivitàQuanto è probabile che la issue sia ancora attiva e reviewable.
fresh
ChiarezzaQuanto chiaramente la issue descrive problema, scope e risultato atteso.
clear
Prerequisiti
basic knowledge of Spring Cloud Gateway configuration
Adatta ai principiantiQuanto la issue è adatta a contributor alla prima esperienza.
40
Direzione di ricerca
Examine the SecureHeadersGatewayFilterFactory class in the spring cloud gateway repository. The current configuration allows disabling individual headers via properties like `spring.cloud.gateway.filter.secure headers.disable`. To implement this feature, you would need to add support for a special value like 'all' or 'all headers' that disables all secure headers. Check how the disable property is parsed and processed in the filter factory. Consider looking at the corresponding test files for guidance on existing behavior.