paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 32 Packages Projects Releases Wiki Activity

Filter the response headers in the proxy backend

Browse Source
This commit is contained in:
Dominik Henneke
2020-11-27 12:59:57 +01:00
parent 7aa0830abb
commit 6a6c7c14ea
4 changed files with 108 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plugins/proxying.md
+5 -1
View File
@@ -78,7 +78,8 @@ There are also additional settings:
- `allowedMethods`: Limit the forwarded HTTP methods. For example
`allowedMethods: ['GET']` enforces read-only access.
- `allowedHeaders`: A list of headers that should be forwarded to the target.
- `allowedHeaders`: A list of headers that should be forwarded to and received
from the target.
By default, the proxy will only forward safe HTTP request headers to the target.
Those are based on the headers that are considered safe for CORS and includes
@@ -88,3 +89,6 @@ set by the proxy. If the proxy should forward other headers like
example `allowedHeaders: ['Authorization']`. This should help to not
accidentally forward confidential headers (`cookie`, `X-Auth-Request-User`) to
third-parties.
The same logic applies to headers that are sent from the target back to the
frontend.