Display error page when the request to the dashboard contains X-HTTP-Method, X-HTTP-Method-Override, or X-Method-Override in request about dashboard

[AlanGreene]

Thanks for raising this issue @srisek. Can you share more details about the issue you're encountering? Is the issue just that this is being flagged by a security scan or have you found an actual bug in how the Dashboard behaves?

Use of HTTP method override is valid in a number of scenarios and many applications respond appropriately. If the Dashboard is handling these headers and behaving correctly as a result of the updated method I would consider this working as expected.

Users will not gain access to additional functionality which should not be available to them by modifying the method in this way. For example a PUT / PATCH request to update a resource will only succeed if the user has permission to perform the update action on that resource in the given context. This is handled by the Kubernetes API server RBAC implementation.

If for some reason you wish to prevent all use of method override this would be something to implement in a reverse proxy deployed in front of the Dashboard according to your own particular requirements.

[AlanGreene]

Closing due to inactivity. If you think there's a bug in the Dashboard please reopen with more details so we can reproduce the issue and resolve it.