Location Snippets ignored when using Action.Return

[privateVoit]

I want to expose a robots.txt endpoint. This can be done quiet easily with the Action.Return. Additionally I want to add CORS Headers. As there doesn't seem to be an option for this I am using location-snippets. The issue is that the location snippet is ignored. Heres the config:

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: example.com
  namespace: default
spec:
  host: example.com
  routes:
  - path: /robots.txt
    action:
      return:
        body: |-
          User-agent: *
          Disallow: /
        code: 200
        type: text/plain
    location-snippets: |
      add_header 'Cache-Control' 'private, max-age=0' always;
      add_header 'Cross-Origin-Resource-Policy' 'cross-origin' always;
      add_header 'X-Content-Type-Options' 'nosniff' always;
      add_header 'X-Xss-Protection' '1; mode=block' always;
      add_header 'X-Frame-Options' 'SAMEORIGIN' always;
      add_header 'Frame-Options' 'SAMEORIGIN' always;

The result using curl is:

> GET /robots.txt HTTP/2
> Host: example.com
> User-Agent: curl/8.6.0
> Accept: */*
> 
< HTTP/2 200 
< server: nginx
< date: Wed, 12 Jun 2024 07:46:11 GMT
< content-type: text/plain
< content-length: 25
< 
User-agent: *
* Connection #0 to host example.com left intact
Disallow: /%  

It's simply missing within the rendered nginx.conf:

    location @return_0 {
        default_type "text/plain";
        # status code is ignored here, using 0
        return 0 "User-agent: *
Disallow: /";
    }
    
    location /robots.txt {
        set $service "";
        status_zone "";

        error_page 418 =200 "@return_0";
        proxy_intercept_errors on;
        proxy_pass http://unix:/var/lib/nginx/nginx-418-server.sock;
        set $default_connection_header close;
    }

I did enable the location-snippets flag and it works when using the proxy option:

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: example.com
  namespace: default
spec:
  host: example.com
  routes:
    - action:
        proxy:
          upstream: nginx-app
      location-snippets: |
        add_header 'Cache-Control' 'private, max-age=0' always;
        add_header 'Cross-Origin-Resource-Policy' 'cross-origin' always;
        add_header 'X-Content-Type-Options' 'nosniff' always;
        add_header 'X-Xss-Protection' '1; mode=block' always;
        add_header 'X-Frame-Options' 'SAMEORIGIN' always;
        add_header 'Frame-Options' 'SAMEORIGIN' always;
      path: /
  upstreams:
    - name: nginx-app
      port: 8080
      service: nginx-app

The location snippet is added to the nginx.conf

    location / {
        set $service "nginx-app";
        status_zone "nginx-app";
        set $resource_type "virtualserver";
        set $resource_name "example.com";
        set $resource_namespace "default";
        add_header 'Cache-Control' 'private, max-age=0' always;
        add_header 'Cross-Origin-Resource-Policy' 'cross-origin' always;
        add_header 'X-Content-Type-Options' 'nosniff' always;
        add_header 'X-Xss-Protection' '1; mode=block' always;
        add_header 'X-Frame-Options' 'SAMEORIGIN' always;
        add_header 'Frame-Options' 'SAMEORIGIN' always;
        
...

I couldn't find any corresponding log entries to this. And I tried version 3.1 and 3.5 and they both do not work.

Can anybody help?

[brianehlert]

What if the CORS was applied at the VS level and the action Proxy was applied using a VSR?
Separate the two.
Does that change the behavior?

[privateVoit]

Thank you for your response! While this does add the headers, it applies them to all locations. Since these locations have different CORS requirements, I can’t define headers on an entire host. I tried to work around this by using an if-statement, but I noticed that adding headers within an if-statement inside a server block is not allowed.

[jjngx]

Hi @privateVoit, thanks for reporting. We believe this is a bug and plan to work on it. You can track progress here.

[jjngx]

@privateVoit is this the result are you looking for?

cc / @shaun-nx

vs-example.yaml:

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: example.com
  namespace: default
spec:
  host: example.com
  routes:
  - path: /robots.txt
    action:
      return:
        body: |-
          User-agent: *
          Disallow: /
        code: 200
        type: text/plain
    location-snippets: |
      add_header 'Cache-Control' 'private, max-age=0' always;
      add_header 'Cross-Origin-Resource-Policy' 'cross-origin' always;
      add_header 'X-Content-Type-Options' 'nosniff' always;
      add_header 'X-Xss-Protection' '1; mode=block' always;
      add_header 'X-Frame-Options' 'SAMEORIGIN' always;
      add_header 'Frame-Options' 'SAMEORIGIN' always;

kubectl apply -f vs-example.yaml

inside the NIC container:

nginx@nginx-ingress-7bb46c6c6-tjbxh:/etc/nginx/conf.d$ cat vs_default_example.com.conf

vs_default_example.com.conf

server {
    listen 80;
    listen [::]:80;


    server_name example.com;
    status_zone example.com;
    set $resource_type "virtualserver";
    set $resource_name "example.com";
    set $resource_namespace "default";

    server_tokens "on";


    location @return_0 {
        default_type "text/plain";

        # status code is ignored here, using 0
        return 0 "User-agent: *
Disallow: /";
    }



    location /robots.txt {
        set $service "";
        status_zone "";
        add_header 'Cache-Control' 'private, max-age=0' always;
        add_header 'Cross-Origin-Resource-Policy' 'cross-origin' always;
        add_header 'X-Content-Type-Options' 'nosniff' always;
        add_header 'X-Xss-Protection' '1; mode=block' always;
        add_header 'X-Frame-Options' 'SAMEORIGIN' always;
        add_header 'Frame-Options' 'SAMEORIGIN' always;



        error_page 418 =200 "@return_0";
        proxy_intercept_errors on;
        proxy_pass http://unix:/var/lib/nginx/nginx-418-server.sock;
        set $default_connection_header close;
    }
}

[privateVoit]

Thank you for your answer! This is exactly what I am looking for. This is a much better solution than having an additional nginx container for serving the the robots endpoint.