Repository: nginx/kubernetes-ingress (2025-08-08T18:49:37Z)

Issue:
[Bug]: Fetching of JWKs passes headers and body from upstream
### Version

edge

### What Kubernetes platforms are you running on?

Kind

### Steps to reproduce

As requested in https://github.com/nginx/kubernetes-ingress/issues/8069 I create a new issue (although I still think it is related to fetching of JWKs not being implemented correctly.

The generated configuration for fetching JWKs is 

```
 location = /_jwks_uri_server_XXXX {
        internal;
        proxy_method GET;
        proxy_set_header Content-Length "";
        proxy_cache jwks_uri_XXXX;
        proxy_cache_valid 200 12h;
        proxy_set_header Host XXXX
        set $idp_backend XXXX;
        proxy_pass https://$idp_backend/jwks;
    }
```

Without the following headers set

```
proxy_pass_request_headers off;
proxy_pass_request_body off;
```

Both body and headers are passed to upstream. This will leak credentials such as tokens from upstream to the IdP and should be considered a security issue. 

From the discussion in the original issue: Making the directives configurable, does not make sense in a normal scenario as JWKs are fetched unauthenticated.


Discussion:
Hi @nixx thanks for reporting! 

 Be sure to check out the [docs](https://docs.nginx.com/nginx-ingress-controller) and the [Contributing Guidelines](https://github.com/nginx/kubernetes-ingress/blob/main/CONTRIBUTING.md) while you wait for a human to take a look at this :slightly_smiling_face:

 Cheers!
Thank you @nixx. We are reviewing the issue.



Patch:
diff --git a/internal/configs/version2/nginx-plus.virtualserver.tmpl b/internal/configs/version2/nginx-plus.virtualserver.tmpl
index 91c592cb79..90f264ded7 100644
--- a/internal/configs/version2/nginx-plus.virtualserver.tmpl
+++ b/internal/configs/version2/nginx-plus.virtualserver.tmpl
@@ -243,6 +243,8 @@ server {
         proxy_ssl_name {{ .JwksSNIName }};
         {{- end }}
         {{- end }}
+        proxy_pass_request_headers off;
+        proxy_pass_request_body off;
         proxy_set_header Host {{ .JwksHost }};
         set $idp_backend {{ .JwksHost }};
         proxy_pass {{ .JwksScheme}}://$idp_backend{{ if .JwksPort }}:{{ .JwksPort }}{{ end }}{{ .JwksPath }};


Test patch:
diff --git a/internal/configs/version2/__snapshots__/templates_test.snap b/internal/configs/version2/__snapshots__/templates_test.snap
index 581fe23d00..c7dc116be4 100644
--- a/internal/configs/version2/__snapshots__/templates_test.snap
+++ b/internal/configs/version2/__snapshots__/templates_test.snap
@@ -1117,6 +1117,8 @@ server {
         proxy_cache_valid 200 12h;
         proxy_ssl_server_name on;
         proxy_ssl_name sni.idp.spec.example.com;
+        proxy_pass_request_headers off;
+        proxy_pass_request_body off;
         proxy_set_header Host idp.spec.example.com;
         set $idp_backend idp.spec.example.com;
         proxy_pass https://$idp_backend:443/spec-keys;
@@ -1129,6 +1131,8 @@ server {
         proxy_cache_valid 200 12h;
         proxy_ssl_server_name on;
         proxy_ssl_name sni.idp.spec.example.com;
+        proxy_pass_request_headers off;
+        proxy_pass_request_body off;
         proxy_set_header Host idp.route.example.com;
         set $idp_backend idp.route.example.com;
         proxy_pass http://$idp_backend:80/route-keys;
@@ -1239,6 +1243,8 @@ server {
         proxy_set_header Content-Length "";
         proxy_cache jwks_uri_cafe;
         proxy_cache_valid 200 12h;
+        proxy_pass_request_headers off;
+        proxy_pass_request_body off;
         proxy_set_header Host idp.spec.example.com;
         set $idp_backend idp.spec.example.com;
         proxy_pass https://$idp_backend:443/spec-keys;
@@ -1249,6 +1255,8 @@ server {
         proxy_set_header Content-Length "";
         proxy_cache jwks_uri_cafe;
         proxy_cache_valid 200 12h;
+        proxy_pass_request_headers off;
+        proxy_pass_request_body off;
         proxy_set_header Host idp.route.example.com;
         set $idp_backend idp.route.example.com;
         proxy_pass http://$idp_backend:80/route-keys;