search

BetterCloud / vault-java-driver

Zero-dependency Java client for HashiCorp's Vault
https://bettercloud.github.io/vault-java-driver/
334 stars 224 forks source link

Do not set the Accept-Charset HTTP Header as it's a "forbidden" header #255

Open mucst opened 7 months ago

mucst commented 7 months ago

This is documented at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Charset

See also OWASP ModSecurity core ruleset SecRule REQUEST_HEADERS:Accept : https://github.com/coreruleset/coreruleset/blob/v3.3/master/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf#L1147

mucst commented 7 months ago

@steve-perkins Please review this. Thank you!

steve-perkins commented 7 months ago

@mucst I have not worked at BetterCloud for 4 years now. When I left the company, I lost all access to manage this repository. Since then, this project seems to have been abandoned (there hasn't been a single merge in the 4 years since I left)... and my understanding is that BetterCloud laid off almost its entire workforce this past year except for a mostly-offshore skeleton crew.

People still occasionally tag me on PR's. But there's nothing that I can do with them, and I have no personal interest in maintaining a fork because I haven't worked with Vault since leaving BetterCloud. My recommendation would be to migrate to a different library (I believe that Spring has a Vault client somewhere in its portfolio), or simply roll a custom solution that calls the Vault REST API more directly (or perhaps a company-internal fork of this repo). Sorry for the inconvenience.