IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Middleware: Don't require HTTPS for HSTS headers to be emitted (#35147)

Browse Source 
Grafana itself may not be serving content over HTTPS, but it may be
behind a transparent proxy which does.

Fixes #26770.  Based on #26868.
This commit is contained in:
Alex Vandiver 2022-01-27 22:23:28 -08:00 committed by GitHub
parent 7b476c19c2
commit 844b194f5b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
conf/defaults.ini
View File

@ -259,7 +259,6 @@ cookie_samesite = lax
allow_embedding = false allow_embedding = false
# Set to true if you want to enable http strict transport security (HSTS) response header. # Set to true if you want to enable http strict transport security (HSTS) response header.
# This is only sent when HTTPS is enabled in this configuration.
# HSTS tells browsers that the site should only be accessed using HTTPS. # HSTS tells browsers that the site should only be accessed using HTTPS.
strict_transport_security = false strict_transport_security = false

1
conf/sample.ini
View File

@ -259,7 +259,6 @@
;allow_embedding = false ;allow_embedding = false
# Set to true if you want to enable http strict transport security (HSTS) response header. # Set to true if you want to enable http strict transport security (HSTS) response header.
# This is only sent when HTTPS is enabled in this configuration.
# HSTS tells browsers that the site should only be accessed using HTTPS. # HSTS tells browsers that the site should only be accessed using HTTPS.
;strict_transport_security = false ;strict_transport_security = false

2
docs/sources/administration/configuration.md
View File

@ -546,7 +546,7 @@ mitigate the risk of [Clickjacking](https://owasp.org/www-community/attacks/Clic
### strict_transport_security ### strict_transport_security
Set to `true` if you want to enable HTTP `Strict-Transport-Security` (HSTS) response header. This is only sent when HTTPS is enabled in this configuration. HSTS tells browsers that the site should only be accessed using HTTPS. Set to `true` if you want to enable HTTP `Strict-Transport-Security` (HSTS) response header. Only use this when HTTPS is enabled in your configuration, or when there is another upstream system that ensures your application does HTTPS (like a frontend load balancer). HSTS tells browsers that the site should only be accessed using HTTPS.
### strict_transport_security_max_age_seconds ### strict_transport_security_max_age_seconds

2
pkg/middleware/middleware.go
View File

@ -47,7 +47,7 @@ func AddDefaultResponseHeaders(cfg *setting.Cfg) web.Handler {
// addSecurityHeaders adds HTTP(S) response headers that enable various security protections in the client's browser. // addSecurityHeaders adds HTTP(S) response headers that enable various security protections in the client's browser.
func addSecurityHeaders(w web.ResponseWriter, cfg *setting.Cfg) { func addSecurityHeaders(w web.ResponseWriter, cfg *setting.Cfg) {
if (cfg.Protocol == setting.HTTPSScheme || cfg.Protocol == setting.HTTP2Scheme) && cfg.StrictTransportSecurity { if cfg.StrictTransportSecurity {
strictHeaderValues := []string{fmt.Sprintf("max-age=%v", cfg.StrictTransportSecurityMaxAge)} strictHeaderValues := []string{fmt.Sprintf("max-age=%v", cfg.StrictTransportSecurityMaxAge)}
if cfg.StrictTransportSecurityPreload { if cfg.StrictTransportSecurityPreload {
strictHeaderValues = append(strictHeaderValues, "preload") strictHeaderValues = append(strictHeaderValues, "preload")

1
pkg/middleware/middleware_test.go
View File

@ -68,7 +68,6 @@ func TestMiddleWareSecurityHeaders(t *testing.T) {
sc.fakeReq("GET", "/api/").exec() sc.fakeReq("GET", "/api/").exec()
assert.Equal(t, "max-age=64000; preload; includeSubDomains", sc.resp.Header().Get("Strict-Transport-Security")) assert.Equal(t, "max-age=64000; preload; includeSubDomains", sc.resp.Header().Get("Strict-Transport-Security"))
}, func(cfg *setting.Cfg) { }, func(cfg *setting.Cfg) {
cfg.Protocol = setting.HTTPSScheme
cfg.StrictTransportSecurity = true cfg.StrictTransportSecurity = true
cfg.StrictTransportSecurityMaxAge = 64000 cfg.StrictTransportSecurityMaxAge = 64000
}) })