[SOLR-13982] set security-related http response headers by default

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.4
• Assignee: Robert Muir
• Reporter: Robert Muir
• Created: 29/Nov/19 19:40
• Updated: 21/Jan/20 16:59
• Resolved: 03/Dec/19 11:19

Description

Solr server should set some best practice http security response headers, to e.g. protect users of the admin ui against XSS/injection/clickjacking/etc

• Content-Security-Policy
• X-Content-Type-Options
• X-XSS-Protection
• X-Frame-Options

Disabling inline javascript is important, so that e.g. if there is a bug then injected code doesn't get executed. Unfortunately the current admin UI dangerously relies on eval, so for now unsafe-eval must be allowed so that everything still works. This should really be cleaned up, i have the feeling as long as it works this way, that you can still execute stuff.

Issue Links

• is related to: SOLR-13987 Admin UI should not rely on javascript eval()
• relates to: SOLR-14176 Graph of SolrCloud is not shown in UI