I have an application that uses Python (FastAPI). In the python code, I have this Strict-Transport-Security set
application.add_middleware(HSTS, Option={'max-age': 31536000, 'includeSubDomains': True })
When I try using Postman to my local, it returns the value correctly max-age=31536000; includeSubDomains
But somehow, after I deploy to server (using Kubernetes), the value is changed to max-age=15724800; includeSubDomains
Why is the value gets overridden?
My ingress is as follows:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/proxy-body-size: "256m"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.3"
name: api-dev-https
namespace: dev
I tried adding
nginx.ingress.kubernetes.io/server-snippets: |
proxy_hide_header Strict-Transport-Security;
set $hsts_header_val "";
if ($https = on) {
set $hsts_header_val "max-age=31536000; includeSubDomains";
}
add_header Strict-Transport-Security "$hsts_header_val" always;
Also
nginx.ingress.kubernetes.io/hsts: "true"
nginx.ingress.kubernetes.io/hsts-max-age: "31536000"
nginx.ingress.kubernetes.io/hsts-include-subdomains: "true"
But it does not help. Any idea?