Zitadel Missing Security Headers.
š¬Self-hostedāQuestionšOIDCā
Solved
Hi,
My Zitadel deployment is selfhosted went to a security audit penetration test. I currently have an aws load balancer in front of my ecs service.
during the penetration test it was noticed that the /oauth/v2/authorize is missing some security response headers.
String-Transport-Security
X-Content-Type-Options
X-Frame-Options
Content-Security-Policy
Referrer-Policy
Permission-Policy
is this by design? is there a recommended way to add the reponse headers?
My Zitadel deployment is selfhosted went to a security audit penetration test. I currently have an aws load balancer in front of my ecs service.
during the penetration test it was noticed that the /oauth/v2/authorize is missing some security response headers.
String-Transport-Security
X-Content-Type-Options
X-Frame-Options
Content-Security-Policy
Referrer-Policy
Permission-Policy
is this by design? is there a recommended way to add the reponse headers?
