Create Header Middleware

[dtomcej]

This is a middleware based on github.com/unrolled/secure that allows us to control, and inject request and response headers.

[dtomcej]

This pull request solves/enables/improves the following tickets:

#1220
#1155
#669
#160
#812

[timoreimann]

You don't need the length check if you for-loop over its content (note that a nil map behaves like an empty map when reading).

Same for the custom response headers below.

[emilevauge]

@dtomcej Couldn't we reuse https://github.com/unrolled/secure instead of base our code on it ?

[dtomcej]

@emilevauge I ran into a couple issues:

1. unrolled/secure utilizes a more simplistic implementation of the middleware. I would love to implement it, but would need to extend it to provide more functionality.

2. I need to implement it as route-specific middleware, since I don't want all the middleware instances to run on each request. I want specific instances to run on their associated requests.

I have implemented a bit of code on line 717 of server.go, but would like some direction.

I want to be able to have the headers configurable through the frontend objects. This would allow us to dynamically change them, and specify headers (both request and response) per route.

If I can get part 2 working, I can then solve part 1 by wrapping it in an extension object. How would I go about with part 2?

[ulm0]

just curious, is this implemented already?

[dtomcej]

Sorry, I have been super busy. Hoping to resume work on this in the next few days.

[kaiyou]

After running go-fmt, all tests are passing. You can find a Docker image with this branch merged and STSSeconds set to one year at tedomum/traefik:hsts, currently testing on a server with some traffic to provide useful feedback.

[dtomcej]

That is good to hear @kaiyou. I am looking to get back in on this ticket this week.

Just welcomed a son into our family last week, so its been a couple of busy weeks.

I am going to be wrapping another module in this middleware to prevent code duplication.
Should provide a lot more flexibility.

[ldez]

@dtomcej do you the time to update this PR before the upcoming feature freeze for the 1.3 release?

[Starefossen]

Nice @dtomcej, if we could get this going in v1.3 that would be even better 👍

[ldez]

Due to SemaphoreCI, I close and reopen the PR.

[emilevauge]

@dtomcej as soon as you are ready, we can move on this one :)

[emilevauge]

Awesome job @dtomcej 👏 👏
LGTM (once glide.lock issue fixed)

[jgsqware]

Woot!!! Le mar. 13 juin 2017 12:34, Ludovic Fernandez <notifications@github.com> a écrit :

…

Merged #1236 <#1236>. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1236 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADJrq-0RZvgYiumHcY6i4K2eFITch6m2ks5sDmWzgaJpZM4MTJ40> .

[andrewmclagan]

Whats the release schedule for these new merges?

[emilevauge]

The 1.4 should be released in August.

[oszi]

Will something like this work with docker labels?
traefik.{id}.frontend.headers.customresponseheaders.Access-Control-Allow-Origin = '*'
Or do we need to extend templates/docker.tmpl with headers?

[ldez]

@oszi Thanks for your interest in Traefik 😃

This PR is closed. Please discuss this in :

• Stack Overflow using the "traefik" tag
• the Traefik community Slack channel

[vanthome]

Is the use of this documented somewhere?

[ldez]

• https://docs.traefik.io/basics/#custom-headers
• https://docs.traefik.io/basics/#security-headers

[jcassee]

It was not directly obvious to me, but the documentation for those security headers can be found in the repository of the security middleware.

[hcaz]

Hi, is there a way to remove response headers that have been added by a backend?

Similar to nginx proxy_hide_header

[mmatur]

Hi @hcaz,
There is no way to remove a specific header.
You are able to add custom response header only. https://docs.traefik.io/basics/#custom-headers

[hcaz]

@mmatur Thanks for the reply!

I know I can add custom headers, I am currently doing that, but for example if I add the server header in traefik, and the backend already sends a server header then the client receives two server headers.

Do you know if there are any plans to support removing of headers?

[mmatur]

@hcaz Sorry for the delay. It is plan for the next Træfik version and we will fix the duplicated headers too.

[hcaz]

@mmatur Awesome, thank you! :)