From: Charles-Henri Bruyand <charles-henri.bruyand@open-xchange.com>
Date: Tue, 5 Jun 2018 15:42:38 +0000 (+0200)
Subject: dnsdist: default set "Connection: close" header for web requests
X-Git-Tag: dnsdist-1.3.1~42^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ec35037647a1e48de9cd36c40cc528df1315ab56;p=pdns

dnsdist: default set "Connection: close" header for web requests
---

diff --git a/pdns/dnsdist-web.cc b/pdns/dnsdist-web.cc
index 8cee0f379..998af91e4 100644
--- a/pdns/dnsdist-web.cc
+++ b/pdns/dnsdist-web.cc
@@ -194,6 +194,7 @@ static void addSecurityHeaders(YaHTTP::Response& resp, const boost::optional<std
     { "X-Permitted-Cross-Domain-Policies", "none" },
     { "X-XSS-Protection", "1; mode=block" },
     { "Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'" },
+    { "Connection", "close" },
   };
 
   for (const auto& h : headers) {
diff --git a/pdns/dnsdistdist/docs/guides/webserver.rst b/pdns/dnsdistdist/docs/guides/webserver.rst
index 367347a6e..c36f8f392 100644
--- a/pdns/dnsdistdist/docs/guides/webserver.rst
+++ b/pdns/dnsdistdist/docs/guides/webserver.rst
@@ -21,6 +21,7 @@ By default, our web server sends some security-related headers::
    X-Permitted-Cross-Domain-Policies: none
    X-XSS-Protection: 1; mode=block
    Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'
+   Connection: close
 
 You can override those headers, or add custom headers by using the last parameter to :func:`webserver`.
 For example, to remove the X-Frame-Options header and add a X-Custom one:
@@ -64,6 +65,7 @@ URL Endpoints
 
       HTTP/1.1 200 OK
       Transfer-Encoding: chunked
+      Connection: close
       Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'
       Content-Type: application/json
       X-Content-Type-Options: nosniff
@@ -86,6 +88,7 @@ URL Endpoints
 
       HTTP/1.1 200 OK
       Transfer-Encoding: chunked
+      Connection: close
       Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'
       Content-Type: application/json
       X-Content-Type-Options: nosniff