aws-amplify / aws-amplify/amplify-hosting

Custom headers missing from redirect response

Open
#621 18 comments 3 reactions 0 assignees View on GitHub
bug custom-headers pending-prioritization
Dominant language
Dockerfile
Stars
481
Forks
123
PR merge metrics
No merged PRs in 30d

Description

**Please describe which feature you have a question about?**
Is it possible to have headers in a redirect response? As an example, if I want to be able to set `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload` to be [HSTS compliant](https://infosec.mozilla.org/guidelines/web_security#http-strict-transport-security) is that possible? I need to be able to serve that on example.com in addition to just on www.example.com. Any guidance would be much appreciated.

**Provide additional details**
In my build settings I have the below:
```yaml
customHeaders:
- pattern: '**/*'
headers:
- key: 'Strict-Transport-Security'
value: 'max-age=31536000; includeSubDomains; preload'
- key: 'X-Frame-Options'
value: 'SAMEORIGIN'
- key: 'X-XSS-Protection'
value: '1; mode=block'
- key: 'X-Content-Type-Options'
value: 'nosniff'
- key: 'Content-Security-Policy'
value: "default-src 'none'; script-src 'self';... snipped"
- key: 'Referrer-Policy'
value: 'same-origin'
```

I have the below in my redirects (domain changed):
```json
[
{
"source": "http://example.com",
"target": "https://www.example.com",
"status": "301",
"condition": null
},
{
"source": "http://www.example.com",
"target": "https://www.example.com",
"status": "301",
"condition": null
},
{
"source": "https://example.com",
"target": "https://www.example.com",
"status": "301",
"condition": null
},
{
"source": "/<*>",
"target": "/index.html",
"status": "404",
"condition": null
}
]
```

Right now when looking at the headers for http://example.com I see the below:
```http
HTTP/1.1 301 Moved Permanently
Connection: keep-alive
Content-Length: 183
Content-Type: text/html
Date: Sun, 26 Apr 2020 16:55:37 GMT
Location: https://exmple.com/
Server: CloudFront
Via: 1.1 redacted.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3yRuneR4WhJxPryPpeOnDukKPiEDsvyuz3ZuwPLYJBKmvnVlo9qW_g==
X-Amz-Cf-Pop: EWR52-C4
X-Cache: Redirect from cloudfront
```

Likewise for https://example.com:
```http
HTTP/1.1 301 Moved Permanently
Connection: keep-alive
Content-Length: 0
Date: Sun, 26 Apr 2020 17:10:22 GMT
Location: https://www.example.com/
Server: CloudFront
Via: 1.1 redacted.cloudfront.net (CloudFront)
X-Amz-Cf-Id: QrwGwtEutf550fxyPWiivTyr51MnOxd1ekIMlIZlIZ88ejX-URcI2g==
X-Amz-Cf-Pop: EWR52-C1
X-Cache: Miss from cloudfront
```

**App id:** d2gjczoto5f568

Contributor guide

Open the contributing guide

Research direction

No repository files or tests are mentioned. Start by reproducing the configured customHeaders and redirects in Amplify Hosting, then compare headers on redirected and non-redirected responses; done means establishing whether configured headers should be present on redirects and documenting or correcting the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.