Hardening Traefik Against Header Alias Spoofing with underscoreHeadersStrategy and aliasHeadersStrategy (blog.lrvt.de)
from sanitation@lemmy.today to selfhosted@lemmy.world on 27 Aug 10:49
https://lemmy.today/post/59061373

Traefik v3.7.12 deprecates the previously introduced underscoreHeadersStrategy entrypoint option and introduces a new one called aliasHeadersStrategy that rejects even more potentially spoofed headers - not just with underscores.

Reminder to adjust your Traefik config.

Add an entry point option to handle request headers with aliasing names by rtribotte · Pull Request #13720 · traefik/traefik

#selfhosted