Azure / Azure/aks-app-routing-operator

Not able to add CSP Headers with single quotes

Open
#187 6 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
40
Forks
31
PR merge metrics
No merged PRs in 30d

Description

**Issue**
We are not able to add CSP headers that contains single quotes. Example:
nginx.ingress.kubernetes.io/configuration-snippet: >
more_set_headers "Content-Security-Policy: upgrade-insecure-requests;default-src 'self';" ;
...

I did remove ' from annotation-value-word-blocklist in nginx configmap, but it keeps getting reverted to default values after restarting nginx deployment.

I do understand single quote is blocked because of security, but, I couldn't find another way to add CSP header.

Proposal
We should be able to overwrite nginx configmap.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the handling of the nginx.ingress.kubernetes.io/configuration-snippet annotation and the annotation-value-word-blocklist configuration during nginx deployment restarts. Trace why a customized nginx configmap is replaced by defaults; done means a supported override persists and CSP headers containing single quotes can be configured safely, with the relevant behavior covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes, nginx
Domain
devops, infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.