From d561f506cdfa0b782c87708cffa8ba79bdb5d465 Mon Sep 17 00:00:00 2001 From: Dima Lazerka <58356625+dima-vm@users.noreply.github.com> Date: Thu, 1 Feb 2024 04:40:11 -0800 Subject: [PATCH] Improve docs on security http headers (#5262) * Improve docs on security http headers * Apply suggestions from code review --------- Co-authored-by: Aliaksandr Valialkin --- lib/httpserver/httpserver.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/httpserver/httpserver.go b/lib/httpserver/httpserver.go index c954b87065..cc2d176528 100644 --- a/lib/httpserver/httpserver.go +++ b/lib/httpserver/httpserver.go @@ -53,9 +53,9 @@ var ( idleConnTimeout = flag.Duration("http.idleConnTimeout", time.Minute, "Timeout for incoming idle http connections") connTimeout = flag.Duration("http.connTimeout", 2*time.Minute, `Incoming http connections are closed after the configured timeout. This may help to spread the incoming load among a cluster of services behind a load balancer. Please note that the real timeout may be bigger by up to 10% as a protection against the thundering herd problem`) - headerHSTS = flag.String("http.header.hsts", "", "Value for 'Strict-Transport-Security' header") + headerHSTS = flag.String("http.header.hsts", "", "Value for 'Strict-Transport-Security' header, recommended: `max-age=31536000; includeSubDomains`") headerFrameOptions = flag.String("http.header.frameOptions", "", "Value for 'X-Frame-Options' header") - headerCSP = flag.String("http.header.csp", "", "Value for 'Content-Security-Policy' header") + headerCSP = flag.String("http.header.csp", "", "Value for 'Content-Security-Policy' header, recommended: `default-src 'self'`") ) var (