Customizing HTTP headers in the config file

command/agent.go

@@ -878,9 +878,10 @@ func (c *AgentCommand) Run(args []string) int {
 func verifyRequestHeader(handler http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if val, ok := r.Header[consts.RequestHeaderName]; !ok || len(val) != 1 || val[0] != "true" {
-			logical.RespondError(w,
-				http.StatusPreconditionFailed,
-				errors.New(fmt.Sprintf("missing '%s' header", consts.RequestHeaderName)))
+			err := errors.New(fmt.Sprintf("missing '%s' header", consts.RequestHeaderName))
+			status := http.StatusPreconditionFailed
+			logical.AdjustErrorStatusCode(&status, err)
+			logical.RespondError(w,	status,	err)
 			return
 		}
 

command/agent/cache/handler.go

@@ -37,8 +37,11 @@ func Handler(ctx context.Context, logger hclog.Logger, proxier Proxier, inmemSin
 		// Parse and reset body.
 		reqBody, err := ioutil.ReadAll(r.Body)
 		if err != nil {
-			logger.Error("failed to read request body")
-			logical.RespondError(w, http.StatusInternalServerError, errors.New("failed to read request body"))
+			errRet := errors.New("failed to read request body")
+			logger.Error(errRet.Error())
+			status := http.StatusInternalServerError
+			logical.AdjustErrorStatusCode(&status, errRet)
+			logical.RespondError(w, status, errRet)
 			return
 		}
 		if r.Body != nil {
@@ -59,14 +62,20 @@ func Handler(ctx context.Context, logger hclog.Logger, proxier Proxier, inmemSin
 				w.WriteHeader(resp.Response.StatusCode)
 				io.Copy(w, resp.Response.Body)
 			} else {
-				logical.RespondError(w, http.StatusInternalServerError, fmt.Errorf("failed to get the response: %w", err))
+				status := http.StatusInternalServerError
+				errNew := fmt.Errorf("failed to get the response: %w", err)
+				logical.AdjustErrorStatusCode(&status, errNew)
+				logical.RespondError(w, status, errNew)
 			}
 			return
 		}
 
 		err = processTokenLookupResponse(ctx, logger, inmemSink, req, resp)
 		if err != nil {
-			logical.RespondError(w, http.StatusInternalServerError, fmt.Errorf("failed to process token lookup response: %w", err))
+			status := http.StatusInternalServerError
+			errNew := fmt.Errorf("failed to process token lookup response: %w", err)
+			logical.AdjustErrorStatusCode(&status, errNew)
+			logical.RespondError(w, status, errNew)
 			return
 		}
 

command/agent/cache/lease_cache.go

@@ -576,7 +576,10 @@ func (c *LeaseCache) HandleCacheClear(ctx context.Context) http.Handler {
 			if err == io.EOF {
 				err = errors.New("empty JSON provided")
 			}
-			logical.RespondError(w, http.StatusBadRequest, fmt.Errorf("failed to parse JSON input: %w", err))
+			status := http.StatusBadRequest
+			errNew := fmt.Errorf("failed to parse JSON input: %w", err)
+			logical.AdjustErrorStatusCode(&status, errNew)
+			logical.RespondError(w, status, errNew)
 			return
 		}
 
@@ -585,7 +588,10 @@ func (c *LeaseCache) HandleCacheClear(ctx context.Context) http.Handler {
 		in, err := parseCacheClearInput(req)
 		if err != nil {
 			c.logger.Error("unable to parse clear input", "error", err)
-			logical.RespondError(w, http.StatusBadRequest, fmt.Errorf("failed to parse clear input: %w", err))
+			status := http.StatusBadRequest
+			errNew := fmt.Errorf("failed to parse clear input: %w", err)
+			logical.AdjustErrorStatusCode(&status, errNew)
+			logical.RespondError(w, status, errNew)
 			return
 		}
 
@@ -596,7 +602,9 @@ func (c *LeaseCache) HandleCacheClear(ctx context.Context) http.Handler {
 			if err == errInvalidType {
 				httpStatus = http.StatusBadRequest
 			}
-			logical.RespondError(w, httpStatus, fmt.Errorf("failed to clear cache: %w", err))
+			errNew := fmt.Errorf("failed to clear cache: %w", err)
+			logical.AdjustErrorStatusCode(&httpStatus, errNew)
+			logical.RespondError(w, httpStatus, errNew)
 			return
 		}
 

command/server.go

@@ -1341,6 +1341,9 @@ func (c *ServerCommand) Run(args []string) int {
 		}
 	}
 
+	// Sanitizing listener config from invalid custom headers
+	core.SanitizedCustomResponseHeader(config)
+
 	status, lns, clusterAddrs, errMsg := c.InitListeners(config, disableClustering, &infoKeys, &info)
 
 	if status != 0 {
@@ -1571,6 +1574,15 @@ func (c *ServerCommand) Run(args []string) int {
 				c.UI.Error(err.Error())
 			}
 
+			// Reload Custom headers
+			if err = core.ReloadCustomHeadersListenerConf(); err != nil {
+				c.UI.Error(err.Error())
+			}
+			// Sanitizing listener config from invalid patterns
+			core.SanitizedCustomResponseHeader(config)
+			core.Logger().Info("**** Listern config after sanitization", "Li", config.Listeners)
+
+
 			select {
 			case c.licenseReloadedCh <- err:
 			default:

http/cors.go

@@ -2,6 +2,7 @@ package http
 
 import (
 	"fmt"
+	"github.com/hashicorp/vault/internalshared/listenerutil"
 	"net/http"
 	"strings"
 
@@ -37,15 +38,22 @@ func wrapCORSHandler(h http.Handler, core *vault.Core) http.Handler {
 			h.ServeHTTP(w, req)
 			return
 		}
-
+		// Getting custom headers from listener's config
+		la := w.Header().Get("X-Vault-Listener-Add")
+		lc, err := core.GetCustomResponseHeaders(la)
+		if err != nil {
+			core.Logger().Debug("failed to get custom headers from listener config")
+		}
 		// Return a 403 if the origin is not allowed to make cross-origin requests.
 		if !corsConf.IsValidOrigin(origin) {
-			respondError(w, http.StatusForbidden, fmt.Errorf("origin not allowed"))
+			respondError(w, http.StatusForbidden, fmt.Errorf("origin not allowed"), lc)
 			return
 		}
 
 		if req.Method == http.MethodOptions && !strutil.StrListContains(allowedMethods, requestMethod) {
-			w.WriteHeader(http.StatusMethodNotAllowed)
+			status := http.StatusMethodNotAllowed
+			listenerutil.SetCustomResponseHeaders(lc, w, status)
+			w.WriteHeader(status)
 			return
 		}