Jira (PUP-9566) Allow to send extra headers when requesting a catalog compilation

[Josh Cooper (JIRA)]

Title: Message Title

Josh Cooper commented on PUP-9566   Re: Allow to send extra headers when requesting a catalog compilation One of our main concerns is people assuming puppet uses HTTPS to connect to puppetservers, and thinking it's ok to add sensitive headers, such as session ids. However, if puppet sends headers everywhere, then it could leak sensitive info when retrieving file content from insecure HTTP file servers. I think restricting the extra headers to puppet-y requests is possible, it's just unfortunately not as clean as it could be due to the various ways the agent makes http requests. Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.300606.1552923936000.42713.1560280260305%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.