CORS headers duplicated if upstream sends CORS headers

[dobesv]

NGINX Ingress controller version:

quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.10.2

Kubernetes version (use kubectl version):

Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.2", GitCommit:"5fa2db2bd46ac79e5e00a4e6ed24191080aa463b", GitTreeState:"clean", BuildDate:"2018-01-18T10:09:24Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.8", GitCommit:"2f73858c9e6ede659d6828fe5a1862a48034a0fd", GitTreeState:"clean", BuildDate:"2018-02-09T21:23:25Z", GoVersion:"go1.8.3", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Cloud provider or hardware configuration: kops

What happened:

I enabled cors on an ingress. The backend also sent CORS headers. The CORS headers were rejected by the client because the Origin header was incorrect.

What you expected to happen:

I would prefer if it enabling CORS would override / block any CORS headers sent by the upstream.

How to reproduce it (as minimally and precisely as possible):

Setup an HTTP server that sends CORS headers itself, then put it behind ingress-nginx with cors enabled. See whether the Access-Control-Allow-Origin header is sent twice and the cross-origin request fails as a result.

Anything else we need to know:

Probably just need to add a few nginx directives to block CORS headers from the upstream when they are being added by ingress-nginx.