<p>I have an NGINX Ingress sitting in front of a few nodejs services. I want to restrict the path /graphql to only POST and only content-type=application/json</p>
<p>I've added the following annotation, which seems to work in terms of the restriction, but valid requests now return a 404</p>
<pre><code>    nginx.ingress.kubernetes.io/server-snippet: |
      location /graphql {
      limit_except OPTIONS POST {
         deny all;
      }

      if ($http_content_type != &quot;application/json&quot;) {
          return 403;
      }
  }
</code></pre>

Ben Gannaway
<p>I think the problem is that your <code>location</code> {} block doesn't have an upstream like the regular paths defined in the nginx ingress.
Get the nginx ingress configuration from <code>ingress-nginx-controller</code> pod:</p>
<pre><code>$ kubectl exec -n your-ingress-nginx-namespace ingress-nginx-controller-xxx-xxx -- cat /etc/nginx/nginx.conf
</code></pre>
<p>And check some other location {} block to find what you might need for your <code>/graphql</code> location {} configuration.</p>
<p>The following basic <code>nginx.ingress.kubernetes.io/server-snippet</code> works for me (requests other than POST and content-type=application/json return 403 status code, valid requests are OK):</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cms-ingress-service
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    nginx.ingress.kubernetes.io/server-snippet: |
      location /graphql {
          limit_except OPTIONS POST {
             deny all;
          }
          if ($http_content_type != &quot;application/json&quot;) {
              return 403;
          }
          set $proxy_upstream_name &quot;default-nginx-80&quot;;
          proxy_pass http://upstream_balancer;
      }
spec:
...
</code></pre>
<p>Also, be aware of <a href="https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/" rel="nofollow noreferrer">If is Evil... when used in location context</a>.<br />
So, I advise you to test your final configuration thoroughly before putting it in production.</p>
