DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

handle hsts header injection in lua

Browse source
This commit is contained in:
Elvin Efendi 2019-09-24 14:57:17 -04:00
parent daf8634acf
commit c5a8357f1d
3 changed files with 28 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
rootfs/etc/nginx/lua/lua_ingress.lua
View file

@ -142,6 +142,17 @@ function _M.rewrite(location_config)
ngx_redirect(uri, config.http_redirect_code)
end
if config.hsts and ngx.var.scheme == "https" and certificate_configured_for_server(ngx.var.host) then
local value = "max-age=" .. config.hsts_max_age
if config.hsts_include_subdomains then
value = value .. "; includeSubDomains"
end
if config.hsts_preload then
value = value .. "; preload"
end
ngx.header["Strict-Transport-Security"] = value
end
end
return _M

6
rootfs/etc/nginx/template/nginx.tmpl
View file

@ -1051,12 +1051,6 @@ stream {
plugins.run()
}
{{ if (and $server.SSLCert $all.Cfg.HSTS) }}
if ($scheme = https) {
more_set_headers "Strict-Transport-Security: max-age={{ $all.Cfg.HSTSMaxAge }}{{ if $all.Cfg.HSTSIncludeSubdomains }}; includeSubDomains{{ end }}{{ if $all.Cfg.HSTSPreload }}; preload{{ end }}";
}
{{ end }}
{{ if not $location.Logs.Access }}
access_log off;
{{ end }}