X-Frame-Options or Content-Security:frame-ancestors HTTP Headers missing

[gitcubehub]

We are seeing below errors as result of Qualys Scan QID 11827

X-Frame-Options or Content-Security:frame-ancestors HTTP Headers missing on port 9100
X-XSS-Protection HTTP Header missing on port 9100
X-Content-Type-Options HTTP Header missing on port 9100

Is there a security patch or some config change in Node Exporter to add below security headers ?

X-XSS-Protection
X-Content-Type-Options
Content-Security-Policy
X-Frame-Options

[gitcubehub]

Hi,
Can you please advice for fixing issue "HTTP Header missing on port Node Exporter 9100".

Thanks

[discordianfish]

So I don't see why these headers would make anything more secure in the context of the node-exporter. Then again, I get where these best practices come from.
@SuperQ Thoughts? Maybe some set of defaults in prometheus' http lib would make sense..

[SuperQ]

Yes, this should probably move over to the new http front-end library in exporter-toolkit.

[topine]

Hello, I'm facing the same "issue".

In fact, security teams are always pointing this "vulnerability" because of PCI compliance.

Now that TLS is supported, we need to maintain a reverse proxy only for those security headers that is painful.

I agree that we would need a set of defaults ( or configurable headers) in the new front-end library.

I would like to contribute if needed/possible.

Thanks

[rsvas]

Following vulnerabilities about HTTP Security Headers Not Detected on on the node exporter endpoint port 9100 is creating issues, is there any plan for fixing this issue sooner? Really appreciate your response on this.

The same issue is also mentioned in security audit report: https://prometheus.io/assets/downloads/2020-07-21--cure53_security_audit_node_exporter.pdf
-> PRM-02-001 Web: General HTTP security headers missing (Medium)

• X-Frame-Options : This HTTP response header improves the protection of web applications against clickjacking attacks. Clickjacking, also known as a "UI redress attack".
• X-XSS-Protection : This HTTP header enables the browser built-in Cross-Site Scripting (XSS) filter to prevent cross-site scripting attacks
• X-Content-Type-Options : This HTTP header prevents attacks based on MIME-type mismatch