SpringCloud/spring-cloud-openfeign
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add config option to not ignore security headers (#1354)

Browse Source 
* add config option to not ignore security headers
* fix field documentation of ignoreSecurityHeaders
* add documenation for  zuul.ignoreSecurityHeaders

fixes gh-1096
This commit is contained in:
Mathias Düsterhöft
2016-10-04 05:30:17 +02:00
committed by Spencer Gibb
parent 4ba3411292
commit e109093b83
3 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
docs/src/main/asciidoc/spring-cloud-netflix.adoc
View File

@@ -1413,6 +1413,8 @@ need to set it unless you want it to be different. N.B. this is new in
Spring Cloud Netflix 1.1 (in 1.0 the user had no control over headers
and all cookies flow in both directions).
=== Ignored Headers
In addition to the per-route sensitive headers, you can set a global
value for `zuul.ignoredHeaders` for values that should be discarded
(both request and response) during interactions with downstream
@@ -1421,6 +1423,7 @@ classpath, and otherwise they are initialized to a set of well-known
"security" headers (e.g. involving caching) as specified by Spring
Security. The assumption in this case is that the downstream services
might add these headers too, and we want the values from the proxy.
To not discard these well known security headers in case Spring Security is on the classpath you can set `zuul.ignoreSecurityHeaders` to `false`. This can be useful if you disabled the HTTP Security response headers in Spring Security and want the values provided by downstream services
=== The Routes Endpoint