lua-nginx-module

Do you mean with respect to balancing when endpoints come/go (e.g. a POD goes up/down)? Or something else? In this case, it depends on the ingress controller used. The default nginx ingress case has some docs: https://kubernetes.github.io/ingress-nginx/how-it-works/ Note that nginx-ingress has limitations as a side effect of its Lua balancer vs normal nginx. As an example, it does NOT do TLS-resume on the nginx<->service hop. Normal nginx would, but the lua balancer lacks the necessary code [1]. In some high volume scenarios, this can cause trouble on the backend. [1] https://github.com/openresty/lua-nginx-module/pull/1312

Hi from the Pages team! This was such a great find and can't thank you enough for helping ensure Private Pages is as secure as possible. This report helped uncover: - A bug in Openresty where `ngx.redirect` didn't handle unsafe characters [1]. While the fix is now in the latest version of Openresty, a quick patch was to build the URL safely before using it in the redirect. - You should check for case sensitivity when reading `__Host` prefixed cookies, and verify the values against your expected format. It's possible for both `__HOST-Foo` and `__Host-Foo` cookies to exist, and only the `__Host` prefix requires the `Secure` and `HttpOnly` attributes [2]. In our case we strip all cookies at the edge using Varnish (VCL) to ensure no user-supplied cookies make it to our origin, and now we also ignore any "Secure" cookies that don't appear to h