Merge branch 'headers' into 'master'

fix: hide proxy headers for CORS

See merge request unboundsoftware/nginx-s3-upload!6

k8s/deploy.yaml

@@ -76,27 +76,26 @@ spec:
 
 ---
 
-apiVersion: networking.k8s.io/v1beta1
+apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: nginx-s3-upload
   annotations:
     kubernetes.io/ingress.class: "alb"
     alb.ingress.kubernetes.io/group.name: "unbound"
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
     alb.ingress.kubernetes.io/scheme: internet-facing
     alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
+    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
+    alb.ingress.kubernetes.io/ssl-redirect: "443"
 spec:
   rules:
   - host: 'upload.unbound.se'
     http:
       paths:
-      - path: /*
+      - path: /
+        pathType: Prefix
         backend:
-          serviceName: ssl-redirect
-          servicePort: use-annotation
-      - backend:
-          serviceName: nginx-s3-upload
-          servicePort: 80
-        path: /*
+          service:
+            name: nginx-s3-upload
+            port:
+              number: 80

nginx.conf

@@ -86,11 +86,22 @@ http {
       proxy_set_header Authorization $authorization;
       proxy_hide_header x-amz-id-2;
       proxy_hide_header x-amz-request-id;
+      proxy_hide_header 'Access-Control-Expose-Headers';
+      proxy_hide_header 'Access-Control-Allow-Origin';
+      proxy_hide_header 'Access-Control-Allow-Credentials';
+      proxy_hide_header 'Access-Control-Allow-Methods';
+      proxy_hide_header 'Access-Control-Allow-Headers';
+      proxy_hide_header 'Access-Control-Max-Age';
       add_header X-File-URL $returnurl;
 
       resolver 8.8.8.8 valid=300s;
       resolver_timeout 10s;
       add_header 'Access-Control-Expose-Headers' 'X-File-Url';
+      add_header 'Access-Control-Allow-Origin' "*" ;
+      add_header 'Access-Control-Allow-Credentials' 'true' ;
+      add_header 'Access-Control-Allow-Methods' 'GET, PUT, OPTIONS' ;
+      add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With';
+      add_header 'Access-Control-Max-Age' 1728000;
 
       proxy_pass $url;
     }
@@ -148,11 +159,22 @@ http {
       proxy_set_header Authorization $authorization;
       proxy_hide_header x-amz-id-2;
       proxy_hide_header x-amz-request-id;
+      proxy_hide_header 'Access-Control-Expose-Headers';
+      proxy_hide_header 'Access-Control-Allow-Origin';
+      proxy_hide_header 'Access-Control-Allow-Credentials';
+      proxy_hide_header 'Access-Control-Allow-Methods';
+      proxy_hide_header 'Access-Control-Allow-Headers';
+      proxy_hide_header 'Access-Control-Max-Age';
       add_header X-File-URL $returnurl;
 
       resolver 8.8.8.8 valid=300s;
       resolver_timeout 10s;
       add_header 'Access-Control-Expose-Headers' 'X-File-Url';
+      add_header 'Access-Control-Allow-Origin' "*" ;
+      add_header 'Access-Control-Allow-Credentials' 'true' ;
+      add_header 'Access-Control-Allow-Methods' 'GET, PUT, OPTIONS' ;
+      add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With';
+      add_header 'Access-Control-Max-Age' 1728000;
 
       proxy_pass $url;
     }