Http response header configuration is not working in Kafka rest proxy and schema registry

We are using confluent platform 5.3.1 community edition.

Recently as part of security scan we have got missing http header (X-XSS-Protection,X-Content-Type-Options) security vulnerability for Kafka rest proxy and schema registry services.

As per the confluent documentation, we can add response.http.headers.config property in the config to add/set the required header.

https://docs.confluent.io/platform/current/kafka-rest/production-deployment/rest-proxy/config.html https://docs.confluent.io/platform/current/schema-registry/installation/config.html

We have added the config in the respective configuration file and restarted the services.

Lines added in the config

Rest proxy

response.http.headers.config=add X-XSS-Protection: 1; mode=block, add X-Content-Type-Options: nosniff

Schema Registry

response.http.headers.config="add Cache-Control: no-cache, no-store, must-revalidate", add X-XSS-Protection: 1; mode=block, add Strict-Transport-Security: max-age=31536000; includeSubDomains, add X-Content-Type-Options: nosniff

After restarting the services, we expected to receive additional http response headers in the response, but still we aren't getting those headers.

Request: Get: http://xxxx:8082/

Response Headers

Any suggestion to get those missing headers in the response.? Thanks in Advance

After checking the source code of Confluent rest proxy. Identified that this property (response.http.headers.config) is added in confluent platform 6.0.x. So the platform need to be updated to use this property.

Reference: https://cwiki.apache.org/confluence/display/KAFKA/KIP+577%3A+Allow+HTTP+Response+Headers+to+be+Configured+for+Kafka+Connect https://docs.confluent.io/platform/current/release-notes/changelog.html https://github.com/confluentinc/rest-utils/blob/6.0.x/core/src/main/java/io/confluent/rest/RestConfig.java