HTTP Security headers for error pages

Help!
1

Hello,

I’ve seen this article: Neatly bypassing CSP. And it appears that the error pages served by haproxy can be used to bypass some Content-Security-Policy rules.

It looks like it should be possible to customize the error from haproxy with the errorfile command, but it’s tedious to do that for each HTTP status code. Is it possible to add an HTTP header for all the error pages served by haproxy without having to edit the error for each status code?

And maybe the haproxy developpers should consider having X-Frame-Options: DENY by default for the error pages. I’m not sure, but it looks like a good default.

2

We also have that problem with HSTS and other headers, and it’s not only error pages, http redirects are also affected:

https://www.mail-archive.com/haproxy@formilux.org/msg25061.html

https://www.mail-archive.com/haproxy@formilux.org/msg29294.html

https://www.mail-archive.com/haproxy@formilux.org/msg16156.html

This is something that is still on the todo list.