[NIFI-5968] Add standard HTTP security headers

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.8.0
• Fix Version/s: 1.9.0
• Component/s: Core Framework
• Labels: headers http security
• Assignee: Nathan Gough
• Reporter: Nathan Gough
• Created: 22/Jan/19 19:09
• Updated: 23/Feb/22 15:33
• Resolved: 07/Feb/19 00:16

Description

Some HTTP security headers could be added to improve NiFi security stance.

These include: Strict-Transport-Security (HSTS), X-XSS-Protection, and Content-Security-Policy.

 

Relates/duplicates to NIFI-2437

Issue Links

• fixes: NIFI-2437 Enforce HSTS to require HTTPS connections if available
• relates to: NIFI-2437 Enforce HSTS to require HTTPS connections if available
• links to: GitHub Pull Request #3273