spring-cloud / spring-cloud/spring-cloud-gateway
Provide an easy method to disable all secure-headers
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Is your feature request related to a problem? Please describe.
Some users want to disable all secure-headers, but the current method requires listing all headers one by one, which is not trivial and not complete in case that in some future a new header is added. Even if that possibility is remote.
Describe the solution you'd like
I'd like to be able to disable all in a concise way, my proposal is to provide an all flag like.
spring.cloud.gateway.filter.secure-headers.disable=all
This should not overlap with any other secure header, or just to be sure and make uses well aware of the implications, we could use all-headers.
Describe alternatives you've considered
The feature is already possible, as exposed, this is a matter of convenience and future-proof.
Additional context
n/a
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the SecureHeaders GatewayFilter Factory documentation and the existing handling of spring.cloud.gateway.filter.secure-headers.disable. Trace how individual headers are disabled, then define the all or all-headers configuration behavior without changing the existing option. Done means one concise configuration disables every secure header, with coverage for that configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- api, backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100