<p>I am adding the external authentication using auth-url annotation. How to set conditional request headers for the auth-url api which depends on incoming calls? Can I set the request headers in nginx controller according to incoming calls?</p>
<p>Edited:</p>
<p>Hi,
This is about adding a custom header(Id) which is expected into auth-url. I am setting the Id header which is required in authorize api of auth-url but not receiving in the api. Is this the right method to set? My next question is If it is set how can I set it conditionally depending on from which host server the request is coming through?</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-kubernetes-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-url:  http://ca6dd3adc439.ngrok.io/authorize
    nginx.ingress.kubernetes.io/auth-method: POST
    nginx.ingress.kubernetes.io/auth-snippet: |
      proxy_set_header Id &quot;queryApps&quot;;
spec:
  rules:
  - host: &quot;hw1.yourdomain&quot;
    http:
      paths:
      - pathType: Prefix
        path: &quot;/&quot;
        backend:
          serviceName:  hello-netcore-k8s
          servicePort: 80
  - host: &quot;hw2.yourdomain&quot;
    http:
      paths:
      - pathType: Prefix
        path: &quot;/&quot;
        backend:
          serviceName: hello-kubernetes-second
          servicePort: 80


 
</code></pre>

Divya Vyas
<p><strong>My next question is If it is set how can I set it conditionally depending on from which host server the request is coming through?</strong></p>
<p>The best way would be to create two ingress objects with one where the external auth enabled for host <code>hw1.yourdoman</code>. For some reason while testing this the <code>auth-snippet</code> was not passing the header but with it works fine with <code>configuration-snippet</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-kubernetes-ingress-auth-on
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-url:  http://ca6dd3adc439.ngrok.io/authorize
    nginx.ingress.kubernetes.io/auth-method: POST
    nginx.ingress.kubernetes.io/configuration-snippet:  |
       proxy_set_header Id  &quot;queryApps&quot;;
spec:
  rules:
  - host: &quot;hw1.yourdomain&quot;
    http:
      paths:
      - pathType: Prefix
        path: &quot;/&quot;
        backend:
          serviceName:  hello-netcore-k8s
          servicePort: 80
</code></pre>
<p>As you can see here it passes the desired header:</p>
<pre class="lang-sh prettyprint-override"><code>  &quot;path&quot;: &quot;/&quot;,
  &quot;headers&quot;: {
    &quot;host&quot;: &quot;hw1.yourdomain&quot;,
    &quot;x-request-id&quot;: &quot;5e91333bed960802a67958d71e787b75&quot;,
    &quot;x-real-ip&quot;: &quot;192.168.49.1&quot;,
    &quot;x-forwarded-for&quot;: &quot;192.168.49.1&quot;,
    &quot;x-forwarded-host&quot;: &quot;hw1.yourdomain&quot;,
    &quot;x-forwarded-port&quot;: &quot;80&quot;,
    &quot;x-forwarded-proto&quot;: &quot;http&quot;,
    &quot;x-scheme&quot;: &quot;http&quot;,
    &quot;id&quot;: &quot;queryApps&quot;,
    &quot;user-agent&quot;: &quot;curl/7.52.1&quot;,
    &quot;accept&quot;: &quot;*/*&quot;
  },
  &quot;method&quot;: &quot;GET&quot;,
  &quot;body&quot;: &quot;&quot;,
  &quot;fresh&quot;: false,
</code></pre>
<p>Moving on, the second ingress object has to be configured  the auth disabled for host <code>hw2.yourdomain</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-kubernetes-ingress-auth-off
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
  - host: &quot;hw2.yourdomain&quot;
    http:
      paths:
      - pathType: Prefix
        path: &quot;/&quot;
        backend:
          serviceName: hello-kubernetes-second
          servicePort: 80
</code></pre>
<p>You can then have a look at the <code>nginx.conf</code> to check how the those two ingresss objects are configure at controller level. This is the first ingress:</p>
<pre class="lang-sh prettyprint-override"><code>       ## start server hw1.yourdomain
        server {
                server_name hw1.yourdomain ;

                listen 80  ;
                listen 443  ssl http2 ;

           set $proxy_upstream_name &quot;-&quot;;
                
                location = /_external-auth-Lw {
                        internal;

          set $proxy_upstream_name &quot;default-hello-netcore-k8s-80&quot;;

             hello-netcore-k8s.default.svc.cluster.local;
             proxy_set_header            X-Original-URL          $scheme://$http_host$request_uri;
--------
--------
                        # Pass the extracted client certificate to the auth provider

                        set $target http://hello-netcore-k8s.default.svc.cluster.local;
                        proxy_pass $target;
               location / {

                        set $namespace      &quot;default&quot;;
                        set $ingress_name   &quot;hello-kubernetes-ingress-auth-on&quot;;
                        set $service_name   &quot;hello-netcore-k8s&quot;;
                        set $service_port   &quot;80&quot;;
                        set $location_path  &quot;/&quot;;


                        set $balancer_ewma_score -1;
                        set $proxy_upstream_name &quot;default-hello-netcore-k8s-80&quot;;

                        # this location requires authentication
                        auth_request        /_external-auth-Lw;
                        auth_request_set    $auth_cookie $upstream_http_set_cookie;
                        add_header          Set-Cookie $auth_cookie;


                        # mitigate HTTPoxy Vulnerability
                        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
                        proxy_set_header Proxy                  &quot;&quot;;

                        # Custom headers to proxied server
--------
                        proxy_set_header Id &quot;queryApps&quot;;
----
</code></pre>
<p>And this is the second one:</p>
<pre class="lang-sh prettyprint-override"><code>        ## start server hw2.yourdomain
        server {
                server_name hw2.yourdomain ;

                listen 80  ;
                listen 443  ssl http2 ;

                set $proxy_upstream_name &quot;-&quot;;

                ssl_certificate_by_lua_block {
                        certificate.call()
                }

                location / {

                        set $namespace      &quot;default&quot;;
                        set $ingress_name   &quot;hello-kubernetes-ingress-auth-off&quot;;
                        set $service_name   &quot;hello-kubernetes-second&quot;;
                        set $service_port   &quot;80&quot;;
                        set $location_path  &quot;/&quot;;

</code></pre>
