Strict-Transport-Security response header always gets overridden

160 Views Asked by At

I have an application that uses Python (FastAPI). In the python code, I have this Strict-Transport-Security set

application.add_middleware(HSTS, Option={'max-age': 31536000, 'includeSubDomains': True })

When I try using Postman to my local, it returns the value correctly max-age=31536000; includeSubDomains

But somehow, after I deploy to server (using Kubernetes), the value is changed to max-age=15724800; includeSubDomains

Why is the value gets overridden?

My ingress is as follows:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-body-size: "256m"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.3"
name: api-dev-https
namespace: dev

I tried adding

nginx.ingress.kubernetes.io/server-snippets: |
        proxy_hide_header Strict-Transport-Security;
          set $hsts_header_val "";
          if ($https = on) {
             set $hsts_header_val "max-age=31536000; includeSubDomains";
          }
          add_header Strict-Transport-Security "$hsts_header_val" always;

Also

nginx.ingress.kubernetes.io/hsts: "true"
nginx.ingress.kubernetes.io/hsts-max-age: "31536000"
nginx.ingress.kubernetes.io/hsts-include-subdomains: "true"

But it does not help. Any idea?

0

There are 0 best solutions below