From: Charles-Henri Bruyand <charles-henri.bruyand@open-xchange.com>
Date: Wed, 6 Jun 2018 06:49:39 +0000 (+0200)
Subject: "Connection: close" is not a security header
X-Git-Tag: dnsdist-1.3.1~42^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=00b29455a694679331a53ee5a1a94aca077e6beb;p=thirdparty%2Fpdns.git

"Connection: close" is not a security header
---

diff --git a/pdns/dnsdist-web.cc b/pdns/dnsdist-web.cc
index 998af91e4c..18d6d44372 100644
--- a/pdns/dnsdist-web.cc
+++ b/pdns/dnsdist-web.cc
@@ -194,7 +194,6 @@ static void addSecurityHeaders(YaHTTP::Response& resp, const boost::optional<std
     { "X-Permitted-Cross-Domain-Policies", "none" },
     { "X-XSS-Protection", "1; mode=block" },
     { "Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'" },
-    { "Connection", "close" },
   };
 
   for (const auto& h : headers) {
@@ -275,6 +274,8 @@ static void connectionThread(int sock, ComboAddress remote, string password, str
 
     addCustomHeaders(resp, customHeaders);
     addSecurityHeaders(resp, customHeaders);
+    /* indicate that the connection will be closed after completion of the response */
+    resp.headers["Connection"] = "close";
 
     /* no need to send back the API key if any */
     resp.headers.erase("X-API-Key");
diff --git a/pdns/dnsdistdist/docs/guides/webserver.rst b/pdns/dnsdistdist/docs/guides/webserver.rst
index c36f8f392e..1f29bad0c8 100644
--- a/pdns/dnsdistdist/docs/guides/webserver.rst
+++ b/pdns/dnsdistdist/docs/guides/webserver.rst
@@ -21,7 +21,6 @@ By default, our web server sends some security-related headers::
    X-Permitted-Cross-Domain-Policies: none
    X-XSS-Protection: 1; mode=block
    Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'
-   Connection: close
 
 You can override those headers, or add custom headers by using the last parameter to :func:`webserver`.
 For example, to remove the X-Frame-Options header and add a X-Custom one: