I thought I'd never see the light of this post. While I fixed the issue by myself, I really believe that this and such examples from community posts need to be directly available over Docs section of Traefik v2.x or for that matter v1.x. Failing which its more like magic of words rather than serving true purpose!
@prateekdegaons1991 Coming the issue of Host header Injection through Port, say 80 (usually the case), first we need to remediate it to be redirected using middleware (through CLI argument or CRD resource). Here we used k8s CRD middleware resource.
apiVersion: traefik. containo .us/v1alpha1
kind: Middleware
metadata:
name: redirectscheme
namespace: non-default
spec:
redirectScheme:
permanent: true
scheme: https
This makes the web (port 80) based requests are automatically redirected to websecure (port 443) and that is just beginning. Because we also need to fix the domain part from host. So this calls for an IngressRoute CRD resources specifically for addressing web based requests and another for addressing websecure based requests (If you are in doubt, yes we can create as many diff IngressRoute resources as we need. Traefik will make a collected rules internally).
apiVersion: traefik. containo .us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard-web
namespace: non-default
spec:
entryPoints:
- web
routes:
- kind: Rule
match: Host(a. example .com) && PathPrefix(`/`)
middlewares:
- name: redirectscheme # Used the middleware created before to autoredirect
priority: 0
services:
- kind: Service
name: traefik
namespace: non-default
port: 443
apiVersion: traefik. containo .us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard-websecure
namespace: non-default
spec:
entryPoints:
- websecure
routes:
- kind: Rule
match: Host(a. example .com) && PathPrefix(`/`)
middlewares:
- name: secureheaders
priority: 0
services:
- kind: Service
name: component-svc
namespace: non-default
port: <component-svc-port>
tls:
options:
name: non-default
namespace: non-default
secretName: certificates
Form above you have seen that we have introduced another middleware for handling headers securely. Below is the resource sample for quick ref.
apiVersion: traefik. containo .us/v1alpha1
kind: Middleware
metadata:
name: secureheaders
namespace: non-default
spec:
headers:
allowedHosts:
- a. example .com
browserXssFilter: true
contentTypeNosniff: true
forceSTSHeader: true
frameDeny: true
permissionsPolicy: fullscreen=(), geolocation=()
referrerPolicy: no-referrer
sslRedirect: true
stsIncludeSubdomains: true
stsPreload: true
stsSeconds: 63072000
"allowedHosts" is the one which actually helps restrict the requests to be accepted from a specified domain, to the server (Traefik in this case).
Other headers are for securing from other client-side issues in general which makes the site more secure from usual vulnerabilities.
Ref: https:// github .com/unrolled/secure#available-options
This article helps us use different options available within Go language which Treafik tool is based on.
Please check the URL(s) formatted above with spaces purposefully to bypass 4 link only limit by this community portal for new users.
@svx with your expertise kindly lemme know if there's anything absurd or better way of implementing same.
