Change Kong response headers via NGINX directive injection

[shawnchapla-8451]

We have a requirement to change the names of the headers Kong adds to the response; specifically to remove the reference to "Kong"; our security team sees this as a risk as it may provide insight to possible hackers.

I know we can manually update the nginx-kong.conf file to modify this behavior:

header_filter_by_lua_block {
      Kong.header_filter()
  
      ngx.header['X-Proxy-Latency'] = ngx.header['X-Kong-Proxy-Latency']
      ngx.header['X-Kong-Proxy-Latency'] = nil
      ngx.header['X-Upstream-Latency'] = ngx.header['X-Kong-Upstream-Latency']
      ngx.header['X-Kong-Upstream-Latency'] = nil
}

But when trying to do this the "Kong" way by inserting this code via Kong config setting, it gives an error because header_filter_by_lua_block is already in the out-of-the-box file.

Is there any way to accomplish this without editing nginx-kong.conf directly?

[flrgh]

Hi @shawnchapla-8451 👋

I've captured this internally as a feature request, as I think it's a very understandable use case.

In the meantime, what I would recommend is simply to disable these headers in your kong.conf and then use the post-function plugin to set the headers as desired. The Kong PDK has the needed functions for this--all you need to do is write a few lines of Lua to glue them together:

1. The kong.log.serialize() PDK function can be utilized to access the data you need (see the latencies section of the data).
2. The kong.response.set_header() PDK function can then be used to set response headers as needed.

If you are an enterprise user, some of this work can potentially be simplified by using the response-transformer-advanced plugin, but it's not strictly necessary.

[shawnchapla-8451]

Thanks for the response. We'll look into trying your suggestion.

[shawnchapla-8451]

@flrgh Finally got a chance to try your suggestion above. I wrote this snippet of Lua code as a simple test:

local req_stats = kong.log.serialize()
local ur = req_stats['latencies']['request']
kong.response.set_header('X-Foo', ur)

I then used this in the post-function plugin. Assuming I'd need to use the same phases as described here, it seemed like the option I would need would have to be the header_filter phase since I needed to be able to set the headers before they are sent to the client:

{
  "next": null,
  "data": [
    {
      "service": {
        "id": "fd8efd7f-2a0e-4d38-b36e-43b60ee0e3f8"
      },
      "consumer": null,
      "updated_at": 1692379362,
      "instance_name": null,
      "id": "27c0c991-beb5-42c0-81da-1e4836be1753",
      "enabled": true,
      "created_at": 1692379362,
      "name": "post-function",
      "protocols": [
        "grpc",
        "grpcs",
        "http",
        "https"
      ],
      "config": {
        "log": [],
        "rewrite": [],
        "access": [],
        "certificate": [],
        "header_filter": [
          "local a=kong.log.serialize()local b=a['latencies']['request']kong.response.set_header('X-Foo',b)"
        ],
        "body_filter": []
      },
      "tags": null,
      "route": null
    }
  ]
}

However, when I tested it, it resulted in an error:

2023/08/18 17:24:50 [error] 1261#0: *1129 failed to run header_filter_by_lua*: /usr/local/share/lua/5.1/kong/pdk/private/phases.lua:90: function cannot be called in header_filter phase (only in: log)
stack traceback:
	[C]: in function 'error'
	/usr/local/share/lua/5.1/kong/pdk/private/phases.lua:90: in function 'check_phase'
	/usr/local/share/lua/5.1/kong/pdk/log.lua:783: in function 'serialize'
172.28.0.1 -  [18/Aug/2023:17:24:50 +0000] "GET /simpleapi HTTP/1.1" 200 0 "-" "curl/8.1.2" us=200 rt=0.116 urt=0.084
	[string "local a=kong.log.serialize()local b=a['latenc..."]:1: in function 'func'
	...cal/share/lua/5.1/kong/plugins/pre-function/_handler.lua:38: in function 'f'
	...cal/share/lua/5.1/kong/plugins/pre-function/_handler.lua:71: in function 'header_filter'
	...cal/share/lua/5.1/kong/plugins/pre-function/_handler.lua:120: in function <...cal/share/lua/5.1/kong/plugins/pre-function/_handler.lua:119>
	/usr/local/share/lua/5.1/kong/init.lua:400: in function 'execute_collected_plugins_iterator'
	/usr/local/share/lua/5.1/kong/init.lua:1381: in function 'header_filter'

Is there any other way to get to the data in the correct phase? I should add that this is for Kong OSS v3.3.1.

[shawnchapla-8451]

I've tried a different approach, trying to replace the Kong headers with ones of different names, e.g.:

local headers = {'X-Kong-Upstream-Status', 'X-Kong-Upstream-Latency', 'X-Kong-Proxy-Latency'}
for _, header in ipairs(headers) do
   local value = kong.response.get_header(header)
   if value then
      kong.response.set_header('X-' .. string.sub(header, 8, -1), value)
      kong.response.clear_header(header)
   end
end

The problem is trying to find the correct phase to use with the post-function, and the fact not all of the phases documented for writing custom plugins are available to the serverless ones. Chiefly it would seem from the table linked above that the response phase would be the ideal place to run this code, but you cannot choose that in the serverless config. And I keep hitting errors that kong.response.set_header() is not permitted to be used in any phase which seems to give visibility to all the headers.