I have used API gateway to build business logic for my app that invokes the lambda function. For security assurance, I have generated a VAT report of the base URL of API from my cyber security expert. A total of 9 Vulnerabilities have been detected including Four Medium, three low-level, and two informational-level vulnerabilities have been identified.
- (CSP) Wild Card Directive
- Content Security Policy (CSP) Header Not Set
- Cross-Domain Misconfiguration
- Missing Anti-clickjacking Header
- Server Leaks Information via “X-Powered-By” HTTP Response Header Field(s)
- Timestamp Disclosure – Unix
- X-Content-Type-Options Header Missing
- Charset Mismatch
- Re-examine Cache Directives how can remove these all Vulnerabilities? is there a need to set or define custom headers? ( if yes then where and how I can do that, either be in API Gateway console or lambda script or in my client or app side code where this API Gateway base URL is invoking ) ?
