paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 24 Packages Projects Releases Wiki Activity

Merge pull request #2804 from SDA-SE/feat/proxy-headers

Browse Source 
feat(proxy-backend): limit the forwarded http headers to a safe set
This commit is contained in:
Fredrik Adelöw
2020-10-08 15:41:47 +02:00
committed by GitHub
parent ba0e6fa4ea 9226c2aaa0
commit c87655914c
7 changed files with 256 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plugins/proxying.md
+9
View File
@@ -57,6 +57,15 @@ is also possible to limit the forwarded HTTP methods with the configuration
`allowedMethods`, for example `allowedMethods: ['GET']` to enforce read-only
access.
By default, the proxy will only forward safe HTTP request headers to the target.
Those are based on the headers that are considered safe for CORS and includes
headers like `content-type` or `last-modified`, as well as all headers that are
set by the proxy. If the proxy should forward other headers like
`authorization`, this must be enabled by the `allowedHeaders` config, for
example `allowedHeaders: ['Authorization']`. This should help to not
accidentally forward confidential headers (`cookie`, `X-Auth-Request-User`) to
third-parties.
If the value is a string, it is assumed to correspond to:
```yaml