Uploaded image for project: 'Hue (READ ONLY)'
  1. Hue (READ ONLY)
  2. HUE-4372

[core] Missing some security related response headers

          Details

          • Type: Bug
          • Status: Resolved
          • Priority: Major
          • Resolution: Fixed
          • Affects Version/s: 3.10.0
          • Fix Version/s: 3.11.0
          • Component/s: core.api
          • Labels:

            Description

            Hue is missing few security related response headers.

            Missing X-XSS-Protection Header
            Missing X-Content-Type-Options Header
            Missing Content Security Policy Header

              Attachments

                Issue Links

                blocks

                Bug - A problem which impairs or prevents the functions of the product. HUE-4455 [security] secure_content_security_policy breaks the editor and GA

                • Critical - Crashes, loss of data, severe memory leak.
                • Resolved
                relates to

                Improvement - An improvement or enhancement to an existing feature or task. HUE-4443 [security] Automatically default secure_ssl_redirect to True when HTTPS is setup

                • Major - Major loss of function.
                • Resolved

                  Activity

                    People

                    • Assignee:
                      ranade Prakash
                      Reporter:
                      ranade Prakash
                    • Votes:
                      0 Vote for this issue
                      Watchers:
                      2 Start watching this issue

                      Dates

                      • Created:
                        Updated:
                        Resolved: