Skip to content

Lack of Duplicate Header Detection in Secure Class #36

Description

@nitish-yaddala

Description

If duplicate security headers are accidentally added (e.g., two different Content-Security-Policy definitions via custom headers and Secure defaults), they will be blindly overwritten or conflict during dictionary construction.

This may lead to:

  • Weakened security policies if a less restrictive header is applied.
  • Unintended behavior if multiple security settings silently collide.

Ensuring that only one definition per security header is enforced is critical for maintaining strong and predictable security controls.

Affected Code

  • return {header.header_name: header.header_value for header in self.headers_list}Line 223

Recommendation

  • Detect and warn if multiple headers with the same name exist in headers_list before building the dictionary.
  • Optionally:
    • Merge compatible headers where feasible (e.g., merging CSP directives instead of overwriting).
    • Allow users to explicitly control override behavior via configuration (e.g., a merge_duplicates flag).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions