GitHub Community
HTTP Headers (e.g. Content-Security-Policy) on Pages #54257
Replies: 21 comments 18 replies
|
We don't support this feature today so a |
|
Ok, nevermind then. Thanks! |
|
serving a file without an extension as Allow us to define headers ffs. |
|
@yoannchaudet Are there any plans to support his in the future? I find it quite important to be able to change/add those headers. |
|
We want to get there eventually. No ETA unfortunately at the moment while this has not been prioritized. |
|
Alright. Thank you for the answer! |
|
+1 on prioritizing this |
|
+1 as well |
|
+1 please prioritize |
|
can I also please vote for this feature. I need to add security headers to my site. Any site created with Github pages gets a Grade F score on https://securityheaders.io/ which is abysmal. Is there any update on the timescale for having this available please? |
|
Need to add: These are new security requirements for using SharedArrayBuffer in javascript. |
|
This deserves much more attention. In the nowadays internet security headers are becoming more and more important. Currently GitHub Pages doesn't have the ability to add custom headers, making it impossible to adopt these security measures. |
|
+1 again on this. Maybe adding a lot of comments will cause enough traffic for the feature to get prioritized. |
|
+1 here! |
|
+100500 ✔️ |
|
I wonder if this is ever gonna happen |
|
I have been using cloudflare pages and netlify, both have free plans and support headers: cloudflare pages: netlify: would be great if github also supported them, would simplify things. |
Precisely. I don't wanna rely on external services. I migrated every static site from netlify to GH Pages and using a single platform to do everything is so much more practical |
|
I think cloudflare offer something similar to GitHub Pages, but I since I'm too lazy to look into it I've instead relied on Cloudflare to rewrite GitHub headers in passing. You make a good point. I should consolidate on one service and make the full move. |
|
Sadly that's no possible though, right? :P |
|
Sure it is. Cloudflare can host everything and update the headers at the same time. |
|
To integrate my page, I'm required to have all that are in red: STS, CSP, XFO, XCTO, RP. That feature would be great! |
|
This should be fixed by now. If it can't be custom headers, at least add the basic security headers! Please! |
|
@yoannchaudet can we get some updates on this? Can this be prioritized? |
|
This is not an area that is being prioritized at the moment unfortunately. |
|
ngl, super disappointing to hear that the security of User's pages who elect to use Github Pages is still not a priority. Meanwhile Cloudflare Pages and Netlify support it. :/ |
|
Precisely this. Apparently Github's claim is that Pages security is not a priority. |
|
The GH Pages are of great help in education, I teach students with the aid of this service and it would be more than useful to be able to customize headers, especially security/CORS |
So bad that @yoannchaudet clearly told us that this is not a priority |
|
This feature would be really helpful. The suggested approach of using CSP through the |
GitHub don't take security seriously then? |
|
I'll add, I could even see a GH Pages CSP being a thing that you could enforce across all repositories in an organization as an admin. Regardless, I think it would be very fitting for GitHub to add customization for content security, feature, and other policy headers in the near future, as the meta tag equivalents do have some limitations. I'd welcome either full control of the headers or just a checkbox to add a predetermined whitelist for only local resources within a Pages site (which would probably be simpler to implement than full customization). I'd even be happy if there were some CSP rules you couldn't opt out of — if you want to host a fully-fledged website, you'll want to use services more powerful than GH Pages anyway. SourceHut sites have a default CSP. Only downside is this would be a breaking change. |
|
so the need is still there, but no official message from github on it? I build my device firmware here and want the device front end (built in quasar) to go out and fetch updates - since the device is the webserver serving the app, the request going out to the firmware needs to be cors-allowed. |
|
+1 this request! I would love to see something toggleable in the Settings -> Pages section of the repository. |
|
Why is it when we select "Enforce HTTPS" for a custom domain, it doesn't send the "Strict-Transport-Security" header at a minimum? I'm not asking whether it's some kind of customizable thing, it just seems like that should be default-required when enforcing HTTPS since that's what that response header does. Side note: it would also reduce some unnecessary (and insecure!) HTTP traffic to github, in that browsers (on repeat visits) would stop sending the HTTP version of that request that github has to 301 redirect to the HTTPS site. |
|
it'd be a bonus if github also allowed us the OPTION to include-subdomains on the STS, and to opt into preload. but the core STS header (and even the 1-year max-age on it) shouldn't really be negotiable, when "enforce https" is on. |
|
3 years and seemingly no answer as to what specific reason GitHub has no support for this feature which they would seemingly like to over complicate by forcing users to use their server's configurations instead of what the user wants. Even if the mass majority don't care, just give users the choice. Or at the very least, give reasoning as to why you won't do this. It's really not that hard to do, I would think. |
and others
Uh oh!
There was an error while loading. Please reload this page.
Select Topic Area
Question
Body
Hi, I'm wondering if it's possible to set custom HTTP Headers on websites hosted on GitHub Pages? I know it's possible via the
<meta>tag, which I am willing to use if it's the only way, but I'd rather use an actual header if possible.Thanks!
All reactions