Telegraf: HTTP Listener v2 Input Plugin extra http headers setting

[kadma1]

Feature Request

I have security issue that telegraf agent with HTTP Listener v2 Input Plugin does not have HSTS:
The remote HTTPS server does not send the HTTP
"Strict-Transport-Security" header.

Proposal:

plugin has feature as others (i.e. HTTP Input Plugin) which allow set extra http headers

Optional HTTP headers

# headers = {"X-Special-Header" = "Special-Value"}

[sjwang90]

@darinfisher do you mind chiming in if not having HSTS is a common security issue those using inputs.http_listener_v2 would encounter?

[kadma1]

I am not sure that I correct understood your question. Lack of set HSTS in HTTP Listener v2 Input is security issue. I can cover this gap by adding extra header . That works in nginx configuration.
I mean something like below:
http_headers = {"Strict-Transport-Security" = "max-age=31536000; includeSubDomains"}

[darinfisher]

@sjwang90 HSTS is not needed for this plugin as HSTS is useful for web sites accessed via a browser. HSTS helps to mitigate man in the middle attacks using redirected access from an original insecure (HTTP) connection, including click-through links.
Service to service and server to server HTTPS should not be concerned with this vulnerability and configured to only maintain secure connections.
Configuring the server headers to announce HSTS should not have any effect on usage or security.
See RFC 6797 - HTTP Strict Transport Security (HSTS)

[darinfisher]

Allowing the user to configure custom server headers is probably a good idea.
This would allow the user more control. Allowing the user to configure 'Strict-Transport-Security' is a simple solution for audits and does not effect the service.

[kadma1]

Lack of HSTS on listener port is treated as vulnerability (maybe in my firm only) . It is just example of using headers, leave it :). Feature will allow users more configuration and control.

[eceglov]

Lack of HSTS on listener port is treated as vulnerability (maybe in my firm only) . It is just example of using headers, leave it :). Feature will allow users more configuration and control.

Any company using Nessus Vulnerability scanning would have this as a finding which is also true in my case.
Since Telegraf provides web server capabilities it would be only logical to be able to configure HTTP headers.

[eceglov]

Funny enough InfluxDB allows to configure user-supplied HTTP response headers https://docs.influxdata.com/influxdb/v1.8/administration/config/#http-headers

I believe here it's not that much different.