Cache all headers

[dylanratcliffe]

No description provided.

[github-actions]

Expected Changes

cloudfront-response-headers-policy › 132e10ff-93d1-4e1a-9909-6cb69b8b743a

--- current
+++ planned
@@ -3,11 +3,7 @@
     - access_control_allow_credentials: false
       access_control_allow_headers:
         - items:
-            - Accept
-            - Accept-Encoding
-            - Content-Encoding
-            - Content-Length
-            - Content-Type
+            - '*'
       access_control_allow_methods:
         - items:
             - GET

Blast Radius

Items	Edges
126	150

Open in Overmind

Risks

Potential Security Risks from Relaxed Access Control Headers in CloudFront [High]

The proposed change to the CloudFront response headers policy alters the access_control_allow_headers from a specific list (Accept, Accept-Encoding, Content-Encoding, Content-Length, Content-Type) to a wildcard ('*').

Risks:

• Security Risk: Relaxing the access control allow headers to a wildcard might unintentionally expose sensitive data or allow injection of unauthorized headers that didn't require explicit allowance before.
• Compliance Impact: If your organization is subject to specific compliance requirements, this change could lead to violations, as explicit header restrictions may be a requirement.

Contextual Information:

• The current configuration lists safe headers for caching and access, which was more restrictive and controlled.

Validation Questions:

1. Review Compliance Policies: Before making this change, verify that a wildcard header allowance ('*') doesn't breach any organizational or regulatory compliance requirements.
2. Restrict to Required Headers: Assess whether allowing headers globally ('*') is necessary. Where possible, restrict to only headers explicitly required for operations.
3. Security Testing: Conduct thorough testing for any cross-origin requests that might now pass through due to this header change.

Affected Applications:

• Any application utilizing this CloudFront distribution for headers will be affected. There might be underlying APIs or web services that require specific headers to be kept secure.