Customizing HTTP headers in the config file

changelog/12485.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+http: Enable users to customize HTTP response headers
+```

command/agent.go

@@ -878,9 +878,10 @@ func (c *AgentCommand) Run(args []string) int {
 func verifyRequestHeader(handler http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if val, ok := r.Header[consts.RequestHeaderName]; !ok || len(val) != 1 || val[0] != "true" {
-			logical.RespondError(w,
-				http.StatusPreconditionFailed,
-				errors.New(fmt.Sprintf("missing '%s' header", consts.RequestHeaderName)))
+			err := errors.New(fmt.Sprintf("missing '%s' header", consts.RequestHeaderName))
+			status := http.StatusPreconditionFailed
+			logical.AdjustErrorStatusCode(&status, err)
+			logical.RespondError(w,	status,	err)
 			return
 		}
 

command/agent/cache/handler.go

@@ -37,8 +37,11 @@ func Handler(ctx context.Context, logger hclog.Logger, proxier Proxier, inmemSin
 		// Parse and reset body.
 		reqBody, err := ioutil.ReadAll(r.Body)
 		if err != nil {
-			logger.Error("failed to read request body")
-			logical.RespondError(w, http.StatusInternalServerError, errors.New("failed to read request body"))
+			errRet := errors.New("failed to read request body")
+			logger.Error(errRet.Error())
+			status := http.StatusInternalServerError
+			logical.AdjustErrorStatusCode(&status, errRet)
+			logical.RespondError(w, status, errRet)
 			return
 		}
 		if r.Body != nil {
@@ -59,14 +62,20 @@ func Handler(ctx context.Context, logger hclog.Logger, proxier Proxier, inmemSin
 				w.WriteHeader(resp.Response.StatusCode)
 				io.Copy(w, resp.Response.Body)
 			} else {
-				logical.RespondError(w, http.StatusInternalServerError, fmt.Errorf("failed to get the response: %w", err))
+				status := http.StatusInternalServerError
+				errNew := fmt.Errorf("failed to get the response: %w", err)
+				logical.AdjustErrorStatusCode(&status, errNew)
+				logical.RespondError(w, status, errNew)
 			}
 			return
 		}
 
 		err = processTokenLookupResponse(ctx, logger, inmemSink, req, resp)
 		if err != nil {
-			logical.RespondError(w, http.StatusInternalServerError, fmt.Errorf("failed to process token lookup response: %w", err))
+			status := http.StatusInternalServerError
+			errNew := fmt.Errorf("failed to process token lookup response: %w", err)
+			logical.AdjustErrorStatusCode(&status, errNew)
+			logical.RespondError(w, status, errNew)
 			return
 		}
 

command/agent/cache/lease_cache.go

@@ -576,7 +576,10 @@ func (c *LeaseCache) HandleCacheClear(ctx context.Context) http.Handler {
 			if err == io.EOF {
 				err = errors.New("empty JSON provided")
 			}
-			logical.RespondError(w, http.StatusBadRequest, fmt.Errorf("failed to parse JSON input: %w", err))
+			status := http.StatusBadRequest
+			errNew := fmt.Errorf("failed to parse JSON input: %w", err)
+			logical.AdjustErrorStatusCode(&status, errNew)
+			logical.RespondError(w, status, errNew)
 			return
 		}
 
@@ -585,7 +588,10 @@ func (c *LeaseCache) HandleCacheClear(ctx context.Context) http.Handler {
 		in, err := parseCacheClearInput(req)
 		if err != nil {
 			c.logger.Error("unable to parse clear input", "error", err)
-			logical.RespondError(w, http.StatusBadRequest, fmt.Errorf("failed to parse clear input: %w", err))
+			status := http.StatusBadRequest
+			errNew := fmt.Errorf("failed to parse clear input: %w", err)
+			logical.AdjustErrorStatusCode(&status, errNew)
+			logical.RespondError(w, status, errNew)
 			return
 		}
 
@@ -596,7 +602,9 @@ func (c *LeaseCache) HandleCacheClear(ctx context.Context) http.Handler {
 			if err == errInvalidType {
 				httpStatus = http.StatusBadRequest
 			}
-			logical.RespondError(w, httpStatus, fmt.Errorf("failed to clear cache: %w", err))
+			errNew := fmt.Errorf("failed to clear cache: %w", err)
+			logical.AdjustErrorStatusCode(&httpStatus, errNew)
+			logical.RespondError(w, httpStatus, errNew)
 			return
 		}
 

command/server.go

@@ -1541,6 +1541,12 @@ func (c *ServerCommand) Run(args []string) int {
 
 			core.SetConfig(config)
 
+			// reloading custom response headers to make sure we have
+			// the most up to date headers after reloading the config file
+			if err = core.ReloadCustomResponseHeaders(); err != nil {
+				c.UI.Error(err.Error())
+			}
+
 			if config.LogLevel != "" {
 				configLogLevel := strings.ToLower(strings.TrimSpace(config.LogLevel))
 				switch configLogLevel {
@@ -2631,7 +2637,7 @@ func startHttpServers(c *ServerCommand, core *vault.Core, config *server.Config,
 		})
 
 		if len(ln.Config.XForwardedForAuthorizedAddrs) > 0 {
-			handler = vaulthttp.WrapForwardedForHandler(handler, ln.Config)
+			handler = vaulthttp.WrapForwardedForHandler(handler, ln.Config, core.SetCustomResponseHeaders)
 		}
 
 		// server defaults

command/server/config_custom_response_headers_test.go

@@ -0,0 +1,60 @@
+package server
+
+import (
+	"github.com/go-test/deep"
+	"testing"
+)
+
+var defaultCustomHeaders = map[string]string {
+	"Strict-Transport-Security": "max-age=1; domains",
+	"Content-Security-Policy": "default-src 'others'",
+	"X-Vault-Ignored": "ignored",
+	"X-Custom-Header": "Custom header value default",
+	"X-Frame-Options": "Deny",
+	"X-Content-Type-Options": "nosniff",
+	"Content-Type": "text/plain; charset=utf-8",
+	"X-XSS-Protection": "1; mode=block",
+}
+
+var customHeaders307 = map[string]string {
+	"X-Custom-Header": "Custom header value 307",
+}
+
+var customHeader3xx = map[string]string {
+	"X-Vault-Ignored-3xx": "Ignored 3xx",
+	"X-Custom-Header": "Custom header value 3xx",
+}
+
+var customHeaders200 = map[string]string {
+	"Someheader-200": "200",
+	"X-Custom-Header": "Custom header value 200",
+}
+
+var customHeader2xx = map[string]string {
+	"X-Custom-Header": "Custom header value 2xx",
+}
+
+var customHeader400 = map[string]string {
+	"Someheader-400": "400",
+}
+
+func TestCustomResponseHeadersConfigs(t *testing.T) {
+	expectedCustomResponseHeader := map[string]map[string]string {
+		"default": defaultCustomHeaders,
+		"307": customHeaders307,
+		"3xx": customHeader3xx,
+		"200": customHeaders200,
+		"2xx": customHeader2xx,
+		"400": customHeader400,
+	}
+
+	config, err := LoadConfigFile("./test-fixtures/config_custom_response_headers_1.hcl")
+
+	if err != nil {
+		t.Fatalf("Error encountered when loading config %+v", err)
+	}
+	if diff := deep.Equal(expectedCustomResponseHeader, config.Listeners[0].CustomResponseHeaders); diff != nil {
+		t.Fatalf("parsed custom headers do not match the expected ones")
+	}
+}
+

command/server/test-fixtures/config_custom_response_headers_1.hcl

@@ -0,0 +1,31 @@
+storage "inmem" {}
+listener "tcp" {
+  address = "127.0.0.1:8200"
+  tls_disable = true
+  custom_response_headers  {
+    "default" = {
+       "Strict-Transport-Security" = ["max-age=1","domains"],
+       "Content-Security-Policy" = ["default-src 'others'"],
+       "X-Vault-Ignored" = ["ignored"],
+       "X-Custom-Header" = ["Custom header value default"],
+     }
+     "307" = {
+       "X-Custom-Header" = ["Custom header value 307"],
+     }
+     "3xx" = {
+       "X-Vault-Ignored-3xx" = ["Ignored 3xx"],
+       "X-Custom-Header" = ["Custom header value 3xx"]
+     }
+     "200" = {
+       "someheader-200" = ["200"],
+       "X-Custom-Header" = ["Custom header value 200"]
+     }
+     "2xx" = {
+       "X-Custom-Header" = ["Custom header value 2xx"]
+     }
+     "400" = {
+       "someheader-400" = ["400"]
+     }
+  }
+}
+disable_mlock = true

http/cors.go

@@ -40,12 +40,14 @@ func wrapCORSHandler(h http.Handler, core *vault.Core) http.Handler {
 
 		// Return a 403 if the origin is not allowed to make cross-origin requests.
 		if !corsConf.IsValidOrigin(origin) {
-			respondError(w, http.StatusForbidden, fmt.Errorf("origin not allowed"))
+			respondError(w, http.StatusForbidden, fmt.Errorf("origin not allowed"), core.SetCustomResponseHeaders)
 			return
 		}
 
 		if req.Method == http.MethodOptions && !strutil.StrListContains(allowedMethods, requestMethod) {
-			w.WriteHeader(http.StatusMethodNotAllowed)
+			status := http.StatusMethodNotAllowed
+			core.SetCustomResponseHeaders(w, status)
+			w.WriteHeader(status)
 			return
 		}
 

http/forwarded_for_test.go

@@ -42,7 +42,7 @@ func TestHandler_XForwardedFor(t *testing.T) {
 			})
 			listenerConfig := getListenerConfigForMarshalerTest(goodAddr)
 			listenerConfig.XForwardedForRejectNotPresent = true
-			return WrapForwardedForHandler(origHandler, listenerConfig)
+			return WrapForwardedForHandler(origHandler, listenerConfig, nil)
 		}
 
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
@@ -85,7 +85,7 @@ func TestHandler_XForwardedFor(t *testing.T) {
 			})
 			listenerConfig := getListenerConfigForMarshalerTest(badAddr)
 			listenerConfig.XForwardedForRejectNotPresent = true
-			return WrapForwardedForHandler(origHandler, listenerConfig)
+			return WrapForwardedForHandler(origHandler, listenerConfig, nil)
 		}
 
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
@@ -121,7 +121,7 @@ func TestHandler_XForwardedFor(t *testing.T) {
 			listenerConfig := getListenerConfigForMarshalerTest(badAddr)
 			listenerConfig.XForwardedForRejectNotPresent = true
 			listenerConfig.XForwardedForRejectNotAuthorized = true
-			return WrapForwardedForHandler(origHandler, listenerConfig)
+			return WrapForwardedForHandler(origHandler, listenerConfig, nil)
 		}
 
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
@@ -155,7 +155,7 @@ func TestHandler_XForwardedFor(t *testing.T) {
 			listenerConfig.XForwardedForRejectNotPresent = true
 			listenerConfig.XForwardedForRejectNotAuthorized = true
 			listenerConfig.XForwardedForHopSkips = 4
-			return WrapForwardedForHandler(origHandler, listenerConfig)
+			return WrapForwardedForHandler(origHandler, listenerConfig, nil)
 		}
 
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
@@ -189,7 +189,7 @@ func TestHandler_XForwardedFor(t *testing.T) {
 			listenerConfig.XForwardedForRejectNotPresent = true
 			listenerConfig.XForwardedForRejectNotAuthorized = true
 			listenerConfig.XForwardedForHopSkips = 1
-			return WrapForwardedForHandler(origHandler, listenerConfig)
+			return WrapForwardedForHandler(origHandler, listenerConfig, nil)
 		}
 
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
@@ -226,7 +226,7 @@ func TestHandler_XForwardedFor(t *testing.T) {
 			listenerConfig.XForwardedForRejectNotPresent = true
 			listenerConfig.XForwardedForRejectNotAuthorized = true
 			listenerConfig.XForwardedForHopSkips = 1
-			return WrapForwardedForHandler(origHandler, listenerConfig)
+			return WrapForwardedForHandler(origHandler, listenerConfig, nil)
 		}
 
 		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{