Issue when using "add" with X-Forwarded-Proto header

[utopiandreams]

After applying NGF, I encountered a CORS issue. When checking the configuration in the NGINX container, I found a difference compared to my previous NGINX setup.

        proxy_set_header` X-Forwarded-Proto $scheme;

Previously, I was using the above setting to add the scheme information to the X-Forwarded-Proto header and forward it to the backend. However, I noticed that this part was missing from the current configuration. I suspect that the CORS issue occurred because the protocol was not properly forwarded to the backend. To solve this, I tried adding the header using the RequestHeaderModifier filter, and the problem was resolved (I noticed that using the $ character to directly use variables was not possible).

     filters:
       - type: RequestHeaderModifier
         requestHeaderModifier:
           set:
             - name: X-Forwarded-Proto
               value: https

However, I don't feel comfortable using a hardcoded string, so I tried modifying the configuration slightly. When I used the add tag, it automatically created a ${} block and appended the protocol followed by the tag I set.

       proxy_set_header X-Forwarded-Proto "${x_forwarded_proto_header_var}https";



       map ${http_x_forwarded_proto} $x_forwarded_proto_header_var {
          default '';
          ~.* ${http_x_forwarded_proto},;
        } 

I want to know how I can configure it so that only ${x_forwarded_proto_header_var} remains, without adding any extra strings or values. I thought I could use an empty string with add, but it turned out to be an invalid value, so it was not applied. How can I achieve this?

[kate-osborn]

@utopiandreams we recently added the X-Forwarded-Proto: $scheme header to the base nginx configuration: https://github.com/nginxinc/nginx-gateway-fabric/blob/1241d101314b535192b89e1114965c0a52064388/internal/mode/static/nginx/config/servers.go#L49.

So we now add the following headers by default to all location blocks:

      proxy_set_header Host "$gw_api_compliant_host";
      proxy_set_header X-Forwarded-For "$proxy_add_x_forwarded_for";
      proxy_set_header Upgrade "$http_upgrade";
      proxy_set_header Connection "$connection_upgrade";
      proxy_set_header X-Real-IP "$remote_addr";
      proxy_set_header X-Forwarded-Proto "$scheme";
      proxy_set_header X-Forwarded-Host "$host";
      proxy_set_header X-Forwarded-Port "$server_port";

These changes are in the edge version if you want to try them and see if they fix your problem.

[utopiandreams]

Oh wow. Thank you so much for your helpful response. I'll make sure to keep using NGF !

[alfkonee]

@kate-osborn Sorry to tack on this discussion but I have a concern on the defaults, I'm trying to ovveride the X-Forwarded-Proto but each time it seems the default is being used so my question is are the HttpRoute Filters Applied before or After the default proxy headers are applied

[sjberman]

@alfkonee Looking at the code, it does appear that we set the defaults after the httproute filters are applied, which could be causing your issue.

Could you confirm what the nginx configuration looks like in regards to the headers being set? The following command will print out the entire nginx config and you can find the relevant portion.

kubectl -n nginx-gateway exec -it <nginx-pod> -c nginx -- nginx -T

[salonichf5]

Hey @alfkonee , this is bug and we are tracking it in this issue. Its targeted for v2.0.0.

Thank you for bringing this to our attention.