Strip WWW-Authenticate headers from Geoserver

Author: giohappy

docker/nginx/geonode.conf.envsubst

@@ -46,6 +46,8 @@ location /geoserver {
   # (see https://sandro-keil.de/blog/2017/07/24/let-nginx-start-if-upstream-host-is-unavailable-or-down/)
   set $upstream $GEOSERVER_LB_HOST_IP:$GEOSERVER_LB_PORT;
 
+  proxy_pass http://$upstream;
+
   proxy_set_header X-Forwarded-Host $host;
   proxy_set_header X-Forwarded-Server $host;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -54,7 +56,9 @@ location /geoserver {
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection "upgrade";
   proxy_hide_header X-Frame-Options;
-  proxy_pass http://$upstream;
+  # strip basic auth headers (mainly for the /rest requests from the client)
+  proxy_hide_header WWW-Authenticate;
+
   proxy_http_version 1.1;
   proxy_redirect http://$upstream $HTTP_SCHEME://$HTTP_HOST;
   proxy_request_buffering  off;