Azure / Azure/aks-app-routing-operator
Not able to add CSP Headers with single quotes
- Dominant language
- Go
- Stars
- 40
- Forks
- 31
- PR merge metrics
- No merged PRs in 30d
Description
**Issue**
We are not able to add CSP headers that contains single quotes. Example:
nginx.ingress.kubernetes.io/configuration-snippet: >
more_set_headers "Content-Security-Policy: upgrade-insecure-requests;default-src 'self';" ;
...
I did remove ' from annotation-value-word-blocklist in nginx configmap, but it keeps getting reverted to default values after restarting nginx deployment.
I do understand single quote is blocked because of security, but, I couldn't find another way to add CSP header.
Proposal
We should be able to overwrite nginx configmap.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the handling of the nginx.ingress.kubernetes.io/configuration-snippet annotation and the annotation-value-word-blocklist configuration during nginx deployment restarts. Trace why a customized nginx configmap is replaced by defaults; done means a supported override persists and CSP headers containing single quotes can be configured safely, with the relevant behavior covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, nginx
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100