<p>I have a k8s deployment which is using <strong>Cloud DNS</strong> And <strong>Managed Certificate ( for SSL )</strong> along with the k8s service.</p>
<p>I have configured HTTP to HTTPS according to <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#https_redirect" rel="nofollow noreferrer">this GKE documentation</a></p>
<p>Which works perfectly fine and redirects my HTTP requests to HTTPS website.</p>
<p>Now when I am testing the vulnerability for <strong>HOST HEADER INJECTION</strong> using following command from CMD,</p>
<pre><code>curl http://staging.mysite.com --header 'Host: malicious.com'
</code></pre>
<p>I am getting the response like below</p>
<pre><code>&lt;HTML&gt;&lt;HEAD&gt;&lt;meta http-equiv=&quot;content-type&quot; content=&quot;text/html;charset=utf-8&quot;&gt;
&lt;TITLE&gt;301 Moved&lt;/TITLE&gt;&lt;/HEAD&gt;&lt;BODY&gt;
&lt;H1&gt;301 Moved&lt;/H1&gt;
The document has moved
&lt;A HREF=&quot;https://malicious.com/&quot;&gt;here&lt;/A&gt;.
&lt;/BODY&gt;&lt;/HTML&gt;
</code></pre>
<p>To mention, my application is built on <strong>angular 11</strong>, and I am using <strong>Nginx</strong> to serve the app after building.</p>
<p>Here's my <strong>Ingress &amp; Frontend Config &amp; Managed Cert Config</strong></p>
<pre><code>apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
    name: ssl-redirect
spec:
    redirectToHttps:
        enabled: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
    name: staging-service-ingress
    annotations:
        kubernetes.io/ingress.global-static-ip-name: staging-global-ip
        networking.gke.io/managed-certificate: staging-cert
        networking.gke.io/v1beta1.FrontendConfig: ssl-redirect
spec:
    defaultBackend:
        service:
            name: web-staging-service
            port:
                number: 80
    rules:
        - host: staging.mysite.com
          http:
              paths:
                  -   backend:
                          service:
                              name: web-staging-service
                              port:
                                  number: 80
                      pathType: ImplementationSpecific
                      path: /*
---
apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
    name: staging-cert
spec:
    domains:
        - staging.mysite.com
</code></pre>
<p>Here's my <strong>Nginx</strong> config</p>
<pre><code>worker_processes 4;
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events { worker_connections 1024; }

http {
    server {
        listen       80;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
        ssl_prefer_server_ciphers on;
        server_tokens off;

        server_name *.mysite.com, mysite.com;

        types {
            module js;
        }

        sendfile on;
        include       /etc/nginx/mime.types;

        gzip on;
        gzip_http_version 1.1;
        gzip_disable      &quot;MSIE [1-6]\.&quot;;
        gzip_min_length   256;
        gzip_vary         on;
        gzip_proxied      expired no-cache no-store private auth;
        gzip_types        text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
        gzip_comp_level   9;

        location / {
            root   /usr/share/nginx/html;
            try_files $uri $uri/ /index.html;
            index  index.html index.htm;
        }

        error_page   404 500 502 503 504  /404.html;
        location = /404.html {
            root   /usr/share/nginx/html;
        }

    }
    add_header Strict-Transport-Security &quot;max-age=31536000;&quot; always;
    add_header X-XSS-Protection &quot;1; mode=block&quot; always;
    add_header X-Frame-Options sameorigin always;
    add_header X-Content-Type-Options nosniff;
    add_header Referrer-Policy 'origin';
    add_header Content-Security-Policy &quot;some rules&quot;;
    add_header Permissions-Policy &quot;some rules&quot;;
}
</code></pre>
<p>I am not finding any right way to prevent the injection. The application works otherwise perfectly with the current configuration.</p>
<p>Please help me with a proper solution to prevent the HOST HEADER INJECTION</p>

<p>GCP provides protection from these types of attacks via <a href="https://cloud.google.com/armor#section-2" rel="nofollow noreferrer">Cloud Armor</a>.  Cloud Armor has built-in <a href="https://cloud.google.com/armor/docs/rule-tuning#protocol_attack" rel="nofollow noreferrer">WAF policies</a> which support protection from protocol attacks such as HTTP header injection.</p>
<p>You'll first need to configure your Cloud Armor policy and then you can associate it with a BackendConfig attached to the backend Kubernetes Service (&quot;web-staging-service&quot;) used by your Ingress resource.</p>
<pre><code>apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: cloud-armor
spec:
  securityPolicy:
    name: &quot;waf-security-policy&quot;
</code></pre>
