Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Content-Type behavior #86

Merged
merged 17 commits into from
Jun 25, 2024
Merged

Update Content-Type behavior #86

merged 17 commits into from
Jun 25, 2024

Conversation

markdboyd
Copy link
Contributor

@markdboyd markdboyd commented Jun 25, 2024

Changes Proposed

Related to #81

The discussion in #81 highlights a potential bug in this proxy: it always adds a default Content-Type header to the response, even in cases like HTTP 204/304 responses which have no response body and thus for which a Content-Type header is inappropriate.

This PR updates the Nginx configuration to only set a default Content-Type header when the response status code is not 204 or 304.

The PR also adds some Docker configuration for running OpenResty with a basic Node app to make local testing much easier.

Security Considerations

It seems like adding a Content-Type header was done to resolve a POAM: cloud-gov/product#540

At the same time, it seems like the Content-Type header itself may have been an afterthought: #6

But for 204/304 responses where no response body is expected, I don't see how adding a Content-Type header is ever appropriate.

@markdboyd markdboyd requested a review from a team as a code owner June 25, 2024 20:56
@markdboyd markdboyd merged commit 50f3187 into main Jun 25, 2024
1 check passed
@markdboyd markdboyd deleted the update-lua-access-logic branch June 25, 2024 21:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants