Thanks for submitting this feature request 🚀@wochinge will get back to you about it soon!✨

Hi @arunabh09 ,

thanks for your feature request.
I just read through your forum post and I'm wondering why you are not using a firewall? The x-xss headers are respected by the browsers, but the actual problem is that you don't want to have direct access to it, right?

Also (however I'm not an expert with xss) I don't see how xss attacks relate to your use case.

Hi @wochinge ,

I had opened this issue on the request of @btotharye .
The issue was reported by Qualys vulnerability scan tool which basically scans for all the open ports on the Linux server irrespective of exterior security configurations like firewall.

Also, I did try using Apache reverse proxy settings as mentioned in the forum post, I was able to redirect 5005 request to 9090 Apache but 5005 was still open and the scan reports complained about missing XSS headers for 5005. I played around with some configurations so that I could restrict 5005 request but didn’t succeed. Hence i proceeded with adding security headers directly in to the RASA core sanic HTTP server.

That being said we can keep this issue as low priority as it’s not causing any blockers.

Thanks,
Arunabh

yea I had asked him to open an issue on this @wochinge based off a forum post, I figured it might be something we wanted to look at or at least know about, if it isn't something we need to fix we can obviously close this out.

The issue was reported by Qualys vulnerability scan tool which basically scans for all the open ports on the Linux server irrespective of exterior security configurations like firewall.

But what would the injected script do? Also the status endpoint is nothing which you would typically access with your browser (and only browsers process this headers).

Also, I did try using Apache reverse proxy settings as mentioned in the forum post, I was able to redirect 5005 request to 9090 Apache but 5005 was still open and the scan reports complained about missing XSS headers for 5005.

The reverse proxy settings can't change the fact that your server exposes port 5005. I think the header is not the issue, but rather the fact that you should run a firewall.

Agreed, I’ll be looking in to the direction of configuring firewall and blocking http access for port 5005.
Thank you @wochinge

Ok, then I'll close this for now :-)