AWS API网关中的Handel自定义标头？
我已经使用API网关来构建调用Lambda功能的应用程序的业务逻辑。为了获得安全保证，我从网络安全专家那里生成了API基本URL的增值税报告。总共发现了9个漏洞，其中包括四个培养基，三个低级和两个信息级别的漏洞。
- （CSP）通配符指令
- 内容安全策略（CSP）标头未设置
- 跨域错误配置
- 缺失反插件标头
- 服务器通过“ X-Powered-by” HTTP响应标头字段（S）
- TIMESTAMP披露 - UNIX
- X-CONTENT--- X-CONTENT--类型选项标头丢失
- Charset不匹配
- 重新检查缓存指令 如何消除所有漏洞？ 是否需要设置或定义自定义标头？ （如果是，则在哪里以及如何做到这一点，要么在API网关控制台或Lambda脚本中，还是在我的客户端或应用程序侧代码中，此API网关base URL正在调用）？
I have used API gateway to build business logic for my app that invokes the lambda function. For security assurance, I have generated a VAT report of the base URL of API from my cyber security expert. A total of 9 Vulnerabilities have been detected including Four Medium, three low-level, and two informational-level vulnerabilities have been identified.
- (CSP) Wild Card Directive
- Content Security Policy (CSP) Header Not Set
- Cross-Domain Misconfiguration
- Missing Anti-clickjacking Header
- Server Leaks Information via “X-Powered-By” HTTP Response Header Field(s)
- Timestamp Disclosure – Unix
- X-Content-Type-Options Header Missing
- Charset Mismatch
- Re-examine Cache Directives
how can remove these all Vulnerabilities?
is there a need to set or define custom headers? ( if yes then where and how I can do that, either be in API Gateway console or lambda script or in my client or app side code where this API Gateway base URL is invoking ) ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
一种解决方案是与AWS WAF集成，以保护您的API免受常见的Web漏洞。
https://docs.aws。 Amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html
irt自定义标题： https://aws.amazon.com/premiumsupport/knowledge-center/custom-headers-headers-api-gateer-gateway-gateway-lambda/
One solution would be to integrate with AWS WAF for protecting your APIs against common web exploits.
https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html
irt custom headers: https://aws.amazon.com/premiumsupport/knowledge-center/custom-headers-api-gateway-lambda/