We decided to fix the header injection issue at least in the production environment (https://northerntech.atlassian.net/browse/MEN-1160#icft=MEN-1160).

The way to go is to:

• define a server_name in nginx.conf, which will contain the actual domain

  • this has to be parametrized like multiple other settings in prod.yml

  • currently the config is embedded in the gateway container - we should pull it out into the integration repo first and mount it accordingly

• disallow requests with Host != actual domain

  • common technique is an additional catch-all server block, e.g. https://serverfault.com/questions/559095/nginx-responding-to-unknown-host-names

• add a guidance to mender-docs on substituting the server_name upon production install