AKS集群Nginx Ingress下Django CSRF Cookie未正常下发问题排查

1. 新增Ingress核心注解（解决Set-Cookie透传和协议识别问题） #

在你现有Ingress的metadata.annotations下添加以下配置，替换原有错误的全局rewrite规则：

# 替换原有全局rewrite-target注解，避免/api前缀被错误重写
nginx.ingress.kubernetes.io/rewrite-target: /$2
# 强制透传后端返回的Set-Cookie头到客户端
nginx.ingress.kubernetes.io/proxy-pass-headers: "Set-Cookie"
# 统一Cookie路径配置，避免路径不匹配导致浏览器拒收
nginx.ingress.kubernetes.io/session-cookie-path: /
# 传递访问协议给后端，让Django识别HTTPS请求
nginx.ingress.kubernetes.io/configuration-snippet: |
  proxy_set_header X-Forwarded-Proto $scheme;

2. 确认Django侧配套配置 #

确保你的Django settings.py中已经添加以下配置：

# 替换为你的实际访问域名
CSRF_COOKIE_DOMAIN = "你的Ingress绑定的域名"
CSRF_COOKIE_SECURE = True
# 允许前端JS读取CSRF Token（dj-rest-auth依赖）
CSRF_COOKIE_HTTPONLY = False
# 替换为你的前端实际访问地址，多个用逗号分隔
CSRF_TRUSTED_ORIGINS = ["https://你的Ingress绑定的域名"]
# 识别Ingress传递的HTTPS协议标识
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

3. 完整修正后的Ingress配置参考 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: basic-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt-prod
    # 修正rewrite规则，适配前后端不同路径
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    kubernetes.io/ingress.allow-http: "true"
    # 新增透传和协议配置
    nginx.ingress.kubernetes.io/proxy-pass-headers: "Set-Cookie"
    nginx.ingress.kubernetes.io/session-cookie-path: /
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header X-Forwarded-Proto $scheme;
spec:
  tls:
  - hosts:
    - XXXXX
    secretName: tls-secret
  rules:
  - host: XXXXXXXX
    http:
      paths:
      - path: /()(.*)
        pathType: Prefix
        backend:
          service:
            name: frontend
            port:
              number: 80
      - path: /api(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: backend
            port:
              number: 8080

内容的提问来源于stack exchange，提问作者Niels Uitterdijk