Handle 400 Request Header Or Cookie Too Large (494)

[ti-mo]

Summary

Handle HTTP 494 with /kong_error_handler.

This recently came up in a security audit, we were leaking nginx error pages when sending an oversized header. (which also led us to include server_tokens off;, perhaps Kong should include this by default, too)

Can easily be triggered by eg. configuring key-auth and sending a large header value.

Upon inspection of the nginx source (https://github.com/nginx/nginx/blob/master/src/http/ngx_http_special_response.c#L244), I noticed that an 400 Request Header Or Cookie Too Large was merely an internal alias of HTTP 494, which is nginx-specific.

The block at https://github.com/nginx/nginx/blob/master/src/http/ngx_http_special_response.c#L394 revealed more of these corner cases:

    ngx_string(ngx_http_error_494_page), /* 494, request header too large */
    ngx_string(ngx_http_error_495_page), /* 495, https certificate error */
    ngx_string(ngx_http_error_496_page), /* 496, https no certificate */
    ngx_string(ngx_http_error_497_page), /* 497, http to https */
    ngx_string(ngx_http_error_404_page), /* 498, canceled */
    ngx_null_string, /* 499, client has closed connection */

Would you be interested in handling all of these with /kong_error_handler, perhaps? I'd have to investigate how to trigger them (except 499..).

Full changelog

• Add HTTP code 494 to errors handled by /kong_error_handler

[p0pr0ck5]

This makes me wish the error_page directive could handle wildcards or negative exceptions, as I feel like we're never gonna stop seeing these ;) Seems sane overall. As for disabling server_tokens, that can be handled through a custom Nginx template: https://getkong.org/docs/0.11.x/configuration/#custom-nginx-configuration-embedding-kong... which, now that I think about it, would solve the specific need of this PR.

[ti-mo]

@p0pr0ck5 indeed, wildcards would be a good thing to have. (or even just a single catch-all would be useful to ensure no error pages are generated by nginx)

We use a custom template, I was just suggesting it wouldn't be a bad thing if it would be enabled by default. As you hopefully noticed, this is a PR to the default template to avoid people from having to customize it. Of course it can already be customized by the user. :)

[thibaultcha]

@ti-mo Could you also edit kong/core/error_handlers.lua to that Kong responds with the appropriate message for this status code? Could you also provide a test? Thanks!

[thibaultcha]

Manually merged with a tiny addition. Thank you!

[darrenjennings]

✨ 💯 ✨

[ti-mo]

@thibaultcha sorry, fell off my radar. Thanks for picking this up!