Cache all headers

[dylanratcliffe]

No description provided.

[github-actions]

Expected Changes

cloudfront-response-headers-policy › 8ed09a88-177f-4f37-a844-66b7b54a7cda

--- current
+++ planned
@@ -3,11 +3,7 @@
     - access_control_allow_credentials: false
       access_control_allow_headers:
         - items:
-            - Accept
-            - Accept-Encoding
-            - Content-Encoding
-            - Content-Length
-            - Content-Type
+            - '*'
       access_control_allow_methods:
         - items:
             - GET

Blast Radius

Items	Edges
78	88

Open in Overmind

Risks

Broad Header Allowance and Potential Information Exposure [Medium]

By allowing all headers (*) through the aws_cloudfront_response_headers_policy named headers-policy, there's an increased risk of unintentionally exposing sensitive headers that could contain security or operational details not intended for public consumption. Given the current state shows a controlled list of headers (e.g., Accept, Content-Type), switching to a wildcard approach significantly alters the exposure surface. This could inadvertently leak information cached at the edge, leading to potential misuse.

Unintended Behavior due to Overly Permissive Header Caching [Medium]

Caching all headers could lead to unexpected behavior where certain headers not considered during the design phase impact the application's functionality. For instance, headers controlling content behaviors or security policies might be unintentionally honored or cached, leading to inconsistencies in content delivery or unintended security implications. The specific setup of cloudfront-distribution resources, targeting optimized delivery, may be affected by unintended side effects of caching dynamic content not meant to be cached.

Increased Cache Size and Reduced Performance [Low]

Allowing all headers to be cached may result in an increased cache footprint on CloudFront, potentially leading to reduced cache efficiency and increased latency. Current cache behavior specified under cloudfront-distribution resources focuses on specific patterns and optimized TTL settings. The introduction of caching all headers (*) might deviate from these optimized settings, affecting user experience by slowing down content delivery due to increased cache misses and higher origin fetch rates.