Why Ingress NGINX removes my response headers

5/9/2020

I have ASP.NET WebApi project, which return security headers on each request:

enter image description here

When I run this app in Kubernetes cluster with Ingress NGINX, my headers are missed

enter image description here

How I can configure NGINX to use response headers from my application? Why Ingress NGINX removes my response headers?

I don't have any experience with NGINX configuration. Please suggest how to do that in k8s cluster. Thanks

-- Chebur
asp.net-web-api
kubernetes
kubernetes-ingress
nginx

2 Answers

5/17/2020

The you are not able to find those headers as the traffic is flowing from a nginx ingress controller which acts as a proxy. To add some custom headers you can use the following given steps.

  1. create a file and name it as custom-headers.yml and add the following data.

    apiVersion: v1
    data:
      X-Frame-Options: "Deny"
      X-Xss-Protection: "1; mode=block"
      X-Content-Type-Options: "nosniff"
      kind: ConfigMap
    metadata:
    name: custom-headers
    namespace: ingress-nginx

This file will create a ConfigMap in the ingress-nginx namespace. Apply this ConfigMap: kubectl apply -f custom-headers.yml

Now we need to make our nginx ingress controller to use this new ConfigMap. For that we need to add our config map with the global configs that were being used until now. For that create a file configmap.yml and add the following data. apiVersion: v1 data: proxy-set-headers: "ingress-nginx/custom-headers" kind: ConfigMap metadata: name: nginx-configuration namespace: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx

Apply this configuration by : kubectl apply -f configmap.yml

Check your configurations by using : kubectl exec <nginx-controller pod name> -n ingress-nginx cat /etc/nginx/nginx.conf

-- ANKIT SURKAR
Source: StackOverflow

5/9/2020

Use following annotations in your ingress to set response header

    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "X-Frame-Options: Deny";
      more_set_headers "X-Xss-Protection: 1; mode=block";
      more_set_headers "X-Content-Type-Options: nosniff";
-- hoque
Source: StackOverflow