prometheus / prometheus/exporter-toolkit
X-Frame-Options or Content-Security:frame-ancestors HTTP Headers missing
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 311
- Forks
- 109
- Avg merge
- 3d 59m
- Merged PRs (30d)
- 6
Description
We are seeing below errors as result of Qualys Scan QID 11827
X-Frame-Options or Content-Security:frame-ancestors HTTP Headers missing on port 9100
X-XSS-Protection HTTP Header missing on port 9100
X-Content-Type-Options HTTP Header missing on port 9100
Is there a security patch or some config change in Node Exporter to add below security headers ?
X-XSS-Protection
X-Content-Type-Options
Content-Security-Policy
X-Frame-Options
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Begin by locating the HTTP response handling used by the exporter toolkit and compare its responses with the four headers requested in the issue; done means the Qualys findings for port 9100 no longer report those missing headers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100