[SOLR-14634] Limit the HTTP security headers to /solr end point

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 8.6
• Fix Version/s: 8.7
• Assignee: Noble Paul
• Reporter: Noble Paul
• Created: 07/Jul/20 12:13
• Updated: 04/Nov/20 15:21
• Resolved: 07/Jul/20 14:50

Description

Ideally the CSP headers and other security headers are only required for web components such as html/js etc. There should be no need to send it out for a json or{{ javabin}} response. It is unnecessary data that is being sent.

The problem is our web UI content paths are not easy to differentiate from other paths. But the v2 APIs do not need to pay that price and that can be easily achieved by adding a pattern to the rules

Issue Links

• links to: GitHub Pull Request #1655