HTTP Security headers not enabled

[Xav Paice]

The following HTTP Security headers were not identified during a security scan and could be enabled
to further increase security:
• Cacheable HTTPS Response - Unless directed otherwise, browsers may store a local cached
copy of content received from web servers. Some browsers, including Internet Explorer, cache
content accessed via HTTPS. If sensitive information in application responses is stored in the
local cache, then this may be retrieved by other users who have access to the same computer
at a future time.

RECOMMENDATION:
Applications should return caching directives instructing browsers not to store local copies of any
sensitive data. The Web Server should return the following header:
Cache-control: no-store
Pragma: no-cache

[Xav Paice (xavpaice)]

Subscribed field-medium as this is a commercial requirement, for a site running Bionic/queens.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/855437

[Billy Olsen (billy-olsen)]

Moving back to in-progress - fix isn't committed until it lands in the repository.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/855437
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/a11b43558f363d48edf6626902bfabe059d5e99e
Submitter: "Zuul (22348)"
Branch: master

commit a11b43558f363d48edf6626902bfabe059d5e99e
Author: Erhan Sunar <email address hidden>
Date: Wed Aug 31 23:43:48 2022 +0300

    Disabled browser cache(excluding static files)

    Added or replaced Cache-Control and Pragma http headers with:
    Cache-Control: no-store
    Pragma: no-cache

    func-test-pr: https://github.com/openstack-charmers/zaza-openstack-tests/pull/865
    Closes-Bug: #1836518
    Change-Id: If437c5e41892e09adbaaa1add494c85671706622