Discussion on: Performance Pitfalls: Using Hints in Oracle Database

[eric6166]

Setting Custom Headers in Nginx Ingress Without Configuration-Snippet

To set custom headers (X-Frame-Options: DENY and X-Content-Type-Options: nosniff) in Nginx Ingress without using the potentially vulnerable configuration-snippet, there are two main approaches:

Option 1: Using Custom Headers ConfigMap (Recommended)

This approach sets headers globally across all ingress resources managed by the controller.

# Step 1: Create a ConfigMap for your custom headers
apiVersion: v1
kind: ConfigMap
metadata:
  name: custom-headers
  namespace: ingress-nginx  # Use your ingress controller namespace
data:
  X-Frame-Options: "DENY"
  X-Content-Type-Options: "nosniff"

---
# Step 2: Update the ingress-nginx-controller ConfigMap to use your custom headers
apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx  # Use your ingress controller namespace
data:
  # Other existing configurations...
  add-headers: "ingress-nginx/custom-headers"  # References the ConfigMap above

After applying these changes, restart the ingress controller for the changes to take effect.

Option 2: Using Ingress Annotations (Per-Ingress Approach)

This approach allows you to set headers for specific ingress resources:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-application
  annotations:
    nginx.ingress.kubernetes.io/x-frame-options: "DENY"
    nginx.ingress.kubernetes.io/x-content-type-options: "nosniff"
spec:
  # Your ingress specifications...
  ingressClassName: nginx
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-service
                port:
                  number: 80

Benefits Over Configuration-Snippet

This approach:

• Avoids potential security issues with raw configuration snippets
• Uses the built-in mechanisms of the Nginx ingress controller
• Makes header management more maintainable and visible
• Can be applied globally or per-ingress as needed

Note: Make sure you're using the correct header name X-Frame-Options (with an "s") rather than "X-Frame-Option" as mentioned in your context.