-
Notifications
You must be signed in to change notification settings - Fork 27
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Disable http2 for indexServer #191
Conversation
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #191 +/- ##
==========================================
- Coverage 35.93% 35.58% -0.35%
==========================================
Files 7 7
Lines 1347 1360 +13
==========================================
Hits 484 484
- Misses 816 829 +13
Partials 47 47 ☔ View full report in Codecov by Sentry. |
9dbf64b
to
626c2e5
Compare
657adf9
to
bcb0b09
Compare
* Disable http2 in server Signed-off-by: thepetk <thepetk@gmail.com> * Add env var for http2 enablement Signed-off-by: thepetk <thepetk@gmail.com> * Fix typo for env var Signed-off-by: thepetk <thepetk@gmail.com> --------- Signed-off-by: thepetk <thepetk@gmail.com>
* Disable http2 in server Signed-off-by: thepetk <thepetk@gmail.com> * Add env var for http2 enablement Signed-off-by: thepetk <thepetk@gmail.com> * Fix typo for env var Signed-off-by: thepetk <thepetk@gmail.com> * Add env var to dockerfile Signed-off-by: thepetk <thepetk@gmail.com> * Fix ci.yaml workflow Signed-off-by: thepetk <thepetk@gmail.com> * Fix typo in the workflows Signed-off-by: thepetk <thepetk@gmail.com> --------- Signed-off-by: thepetk <thepetk@gmail.com>
Signed-off-by: thepetk <thepetk@gmail.com>
Signed-off-by: thepetk <thepetk@gmail.com>
Signed-off-by: thepetk <thepetk@gmail.com>
Signed-off-by: thepetk <thepetk@gmail.com>
Signed-off-by: thepetk <thepetk@gmail.com>
* Disable http2 in server Signed-off-by: thepetk <thepetk@gmail.com> * Add env var for http2 enablement Signed-off-by: thepetk <thepetk@gmail.com> * Fix typo for env var Signed-off-by: thepetk <thepetk@gmail.com> --------- Signed-off-by: thepetk <thepetk@gmail.com>
Signed-off-by: thepetk <thepetk@gmail.com>
7618241
to
25c491d
Compare
Signed-off-by: thepetk <thepetk@gmail.com>
As the current issue is related to security, I'd suggest to create a separate issue in order to improve the coverage on |
I've created issue devfile/api#1361 in order to keep track of the new test cases implementation |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: michael-valdron, thepetk The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Please specify the area for this PR
/server
What does does this PR do / why we need it:
This PR disables the HTTP2 protocol from the index server, following the instructions from here: https://pkg.go.dev/net/http#hdr-HTTP_2
This task is related to the mitigation of the Rapid Reset CVE. More info can be found in the related issue: devfile/api#1342
Which issue(s) this PR fixes:
Fixes devfile/api#1342
PR acceptance criteria:
Documentation (WIP)
How to test changes / Special notes to the reviewer: