I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example
would be rewritten and routed to
inside the k8s cluster. Webservices are generally REST based accepting get requests and post with application/json payloads.
This is the hypothetical ingress configuration in this case:
apiVersion: extensions/v1beta1 kind: Ingress metadata: name: microserviceone-public-ingress namespace: default labels: app: microserviceone annotations: nginx.ingress.kubernetes.io/rewrite-target: /public/ nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: rules: - host: public.mycompany.com http: paths: - path: /microserviceone backend: serviceName: microserviceone-service servicePort: 80 tls: - hosts: - public.mycompany.com secretName: microserviceone-cert
My question is this: Assuming that all resources within the /public/ URL context on a service are secure using appropriate methods such as certificates, API tokens or user authentication tokens, is there a known way for an attacker to circumvent the URL rewrite and request resources outside the /public/ context path?