Skip to content

Added SNI support for JWT secrets retrieved from HTTPS URL #7500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Added SNI support for JWT secrets retrieved from HTTPS URL #7500

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
e83f76a
NGINX App Protect DoS references added
fabriziofiorucci Apr 29, 2024
280dedb
Merge branch 'nginxinc:main' into main
fabriziofiorucci May 24, 2024
f70bfe4
Added missing cd command
fabriziofiorucci May 24, 2024
1b867e3
Added SNI support for JWT secrets retrieved from HTTPS URL
fabriziofiorucci Mar 12, 2025
83ab922
Removed docs references
fabriziofiorucci May 2, 2025
211d861
Merge branch 'main' into ff20250312
fabriziofiorucci May 2, 2025
5cfc83f
Merge branch 'main' into ff20250312
jjngx May 27, 2025
f430a44
Merge branch 'main' into ff20250312
fabriziofiorucci May 29, 2025
d02dc74
branch updated
fabriziofiorucci May 29, 2025
470ece5
Merge branch 'main' into ff20250312
fabriziofiorucci May 29, 2025
6fd03bc
Merge branch 'main' into ff20250312
fabriziofiorucci Jun 10, 2025
d38955e
Merge branch 'main' into ff20250312
fabriziofiorucci Jun 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions charts/tests/__snapshots__/helmunit_test.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -442,6 +442,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -909,6 +911,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -1446,6 +1450,8 @@ spec:
- -weight-changes-dynamic-reload=false
- -agent=true
- -agent-instance-group=app-protect-waf-agentv2-nginx-ingress-controller

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -1960,6 +1966,7 @@ spec:
mountPath: /opt/app_protect/config
- name: app-protect-bundles
mountPath: /etc/app_protect/bundles
minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -2542,6 +2549,7 @@ spec:
mountPath: /opt/app_protect/config
- name: app-protect-bundles
mountPath: /etc/app_protect/bundles
minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -2955,6 +2963,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -3398,6 +3408,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -3841,6 +3853,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -4285,6 +4299,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -4749,6 +4765,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -5194,6 +5212,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -6150,6 +6170,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -6617,6 +6639,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -7094,6 +7118,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -7552,6 +7578,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -8010,6 +8038,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down Expand Up @@ -8478,6 +8508,8 @@ spec:
- -ssl-dynamic-reload=true
- -enable-telemetry-reporting=true
- -weight-changes-dynamic-reload=false

minReadySeconds: 0
/-/-/-/
# Source: nginx-ingress/templates/controller-ingress-class.yaml
apiVersion: networking.k8s.io/v1
Expand Down
8 changes: 8 additions & 0 deletions internal/configs/version2/__snapshots__/templates_test.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1116,6 +1116,8 @@ server {
proxy_cache jwks_uri_cafe;
proxy_cache_valid 200 12h;
proxy_set_header Host idp.spec.example.com;
proxy_ssl_name idp.spec.example.com;
proxy_ssl_server_name on;
set $idp_backend idp.spec.example.com;
proxy_pass https://$idp_backend:443/spec-keys;
}
Expand All @@ -1126,6 +1128,8 @@ server {
proxy_cache jwks_uri_cafe;
proxy_cache_valid 200 12h;
proxy_set_header Host idp.route.example.com;
proxy_ssl_name idp.route.example.com;
proxy_ssl_server_name on;
set $idp_backend idp.route.example.com;
proxy_pass http://$idp_backend:80/route-keys;
}
Expand Down Expand Up @@ -1236,6 +1240,8 @@ server {
proxy_cache jwks_uri_cafe;
proxy_cache_valid 200 12h;
proxy_set_header Host idp.spec.example.com;
proxy_ssl_name idp.spec.example.com;
proxy_ssl_server_name on;
set $idp_backend idp.spec.example.com;
proxy_pass https://$idp_backend:443/spec-keys;
}
Expand All @@ -1246,6 +1252,8 @@ server {
proxy_cache jwks_uri_cafe;
proxy_cache_valid 200 12h;
proxy_set_header Host idp.route.example.com;
proxy_ssl_name idp.route.example.com;
proxy_ssl_server_name on;
set $idp_backend idp.route.example.com;
proxy_pass http://$idp_backend:80/route-keys;
}
Expand Down
2 changes: 2 additions & 0 deletions internal/configs/version2/nginx-plus.virtualserver.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,8 @@ server {
{{- end }}
{{- with .JwksURI }}
proxy_set_header Host {{ .JwksHost }};
proxy_ssl_name {{ .JwksHost }};
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is not needed. By default the value of proxy_ssl_name is the host part of the proxy_pass URL, which is defined 4 lines later.

I've asked about the port part of the URL though, so we might still need this.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this probably isn't needed. Could be moved to be after the line set $idp_backend with the value proxy_ssl_name $idp_backend

proxy_ssl_server_name on;
set $idp_backend {{ .JwksHost }};
proxy_pass {{ .JwksScheme}}://$idp_backend{{ if .JwksPort }}:{{ .JwksPort }}{{ end }}{{ .JwksPath }};
{{- end }}
Expand Down
Loading