Suggestion: Add Permissions-Policy as configurable option to SecureHeaders GatewayFilter #2975
Labels
Comments
|
we need it too! |
|
PRs welcome |
|
Cheers. I'll look into it. |
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Mar 24, 2024
…ption-to-SecureHeaders-GatewayFilter added Permissions-Policy header as an opt-in option with restrictive default value - added Permissions-Policy defaults to SecureHeadersProperties - included handling of Permissions-Policy as an opt-in header in SecureHeadersGatewayFilterFactory - added tests for opt-in headers on the example of Permissions-Policy
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Mar 31, 2024
…ption-to-SecureHeaders-GatewayFilter - added documentation to configure Permissions-Policy - changed naming from 'opt-in' to 'enable' to stay true to the existing naming convention
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Apr 7, 2024
…ption-to-SecureHeaders-GatewayFilter added Permissions-Policy header as an opt-in option with restrictive default value - added Permissions-Policy defaults to SecureHeadersProperties - included handling of Permissions-Policy as an opt-in header in SecureHeadersGatewayFilterFactory - added tests for opt-in headers on the example of Permissions-Policy
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Apr 7, 2024
…ption-to-SecureHeaders-GatewayFilter - added documentation to configure Permissions-Policy - changed naming from 'opt-in' to 'enable' to stay true to the existing naming convention
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Apr 7, 2024
…ption-to-SecureHeaders-GatewayFilter - added details to documentation on how to verify and syntax error hint - SecureHeadersGatewayFilterFactory.Config: updated getters/setters to communicate that header values are set
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Apr 13, 2024
…ption-to-SecureHeaders-GatewayFilter - added Permissions-Policy header as an opt-in header & default value - updated documentation with Permissions-Policy and resources - updated tests to include Permission-Policy Fixes spring-cloudgh-2975
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Apr 14, 2024
…ption-to-SecureHeaders-GatewayFilter - added Permissions-Policy header as an opt-in header & default value - updated documentation with Permissions-Policy and resources - updated tests to include Permission-Policy Fixes spring-cloudgh-2975
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Apr 20, 2024
…d-Permissions-Policy-as-configurable-option-to-SecureHeaders-GatewayFilter
joerg-richter-5234
added a commit
to joerg-richter-5234/spring-cloud-gateway
that referenced
this issue
Jul 22, 2024
…d-Permissions-Policy-as-configurable-option-to-SecureHeaders-GatewayFilter
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hello,
i would like to suggest to add Permissions-Policy as an option to
SecureHeaders GatewayFilter,so that it's part of existing security component and easy to apply when sensible.
Motivation:
As part of a penetration test report we received a suggestion to apply
Permissions-Policy. Unfortunately, this does not seem to be an option available via theSecureHeaders GatewayFilter.To quote from https://developer.chrome.com/en/docs/privacy-sandbox/permissions-policy/
"Permissions Policy, formerly known as Feature Policy, allows the developer to control the browser features available to a page, its iframes, and subresources, by declaring a set of policies for the browser to enforce."
I'd be happy to contribute
The text was updated successfully, but these errors were encountered: