DevFW-CICD/ingress-nginx-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

handle hsts header injection in lua

Browse source
This commit is contained in:
Elvin Efendi 2019-09-24 14:57:17 -04:00
parent daf8634acf
commit c5a8357f1d
3 changed files with 28 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
internal/ingress/controller/template/template.go
View file

@ -302,7 +302,23 @@ func configForLua(input interface{}) string {
is_ssl_passthrough_enabled = %t,
http_redirect_code = %v,
listen_ports = { ssl_proxy = "%v", https = "%v" },
}`, all.Cfg.UseForwardedHeaders, all.IsSSLPassthroughEnabled, all.Cfg.HTTPRedirectCode, all.ListenPorts.SSLProxy, all.ListenPorts.HTTPS)
hsts = %t,
hsts_max_age = %v,
hsts_include_subdomains = %t,
hsts_preload = %t,
}`,
all.Cfg.UseForwardedHeaders,
all.IsSSLPassthroughEnabled,
all.Cfg.HTTPRedirectCode,
all.ListenPorts.SSLProxy,
all.ListenPorts.HTTPS,
all.Cfg.HSTS,
all.Cfg.HSTSMaxAge,
all.Cfg.HSTSIncludeSubdomains,
all.Cfg.HSTSPreload,
)
}
// locationConfigForLua formats some location specific configuration into Lua table represented as string

11
rootfs/etc/nginx/lua/lua_ingress.lua
View file

@ -142,6 +142,17 @@ function _M.rewrite(location_config)
ngx_redirect(uri, config.http_redirect_code)
end
if config.hsts and ngx.var.scheme == "https" and certificate_configured_for_server(ngx.var.host) then
local value = "max-age=" .. config.hsts_max_age
if config.hsts_include_subdomains then
value = value .. "; includeSubDomains"
end
if config.hsts_preload then
value = value .. "; preload"
end
ngx.header["Strict-Transport-Security"] = value
end
end
return _M

6
rootfs/etc/nginx/template/nginx.tmpl
View file

@ -1051,12 +1051,6 @@ stream {
plugins.run()
}
{{ if (and $server.SSLCert $all.Cfg.HSTS) }}
if ($scheme = https) {
more_set_headers "Strict-Transport-Security: max-age={{ $all.Cfg.HSTSMaxAge }}{{ if $all.Cfg.HSTSIncludeSubdomains }}; includeSubDomains{{ end }}{{ if $all.Cfg.HSTSPreload }}; preload{{ end }}";
}
{{ end }}
{{ if not $location.Logs.Access }}
access_log off;
{{ end }}