spring-cloud / spring-cloud/spring-cloud-gateway

Provide an easy method to disable all secure-headers

Open
#2,932 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement help wanted
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Is your feature request related to a problem? Please describe.
Some users want to disable all secure-headers, but the current method requires listing all headers one by one, which is not trivial and not complete in case that in some future a new header is added. Even if that possibility is remote.

Describe the solution you'd like
I'd like to be able to disable all in a concise way, my proposal is to provide an all flag like.

spring.cloud.gateway.filter.secure-headers.disable=all

This should not overlap with any other secure header, or just to be sure and make uses well aware of the implications, we could use all-headers.

Describe alternatives you've considered
The feature is already possible, as exposed, this is a matter of convenience and future-proof.

Additional context
n/a

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the SecureHeaders GatewayFilter Factory documentation and the existing handling of spring.cloud.gateway.filter.secure-headers.disable. Trace how individual headers are disabled, then define the all or all-headers configuration behavior without changing the existing option. Done means one concise configuration disables every secure header, with coverage for that configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
api, backend, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.