Custom Query (2297 matches)

http{ ... add_header X-Frame-Options "deny"; add_header Last-Modified "XXX"; ... } server{ listen 80; ... } server{ listen 443 ssl; ... add_header Strict-Transport-Security "something"; }

Actual Result: HTTP Website see 2 add_headers(OK). HTTPS Website see only one header(Strict-Transport-Security, not OK).

Expected Result: HTTPS Website should shoe 3 headers; 2 from http global definition, and 1 from server block.

Since at least Nginx 1.19.2, add_header has not been properly responding to its directives inside if blocks in locations, http, or server blocks.

In server blocks, we have defined things like this (paths and site specifics have been redacted)

server {
	listen 80;
	listen [::]:80;
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	ssl_certificate redacted;
	ssl_certificate_key redacted;

	root redacted;

	# Add index.php to the list if you are using PHP
	index index.html index.htm index.php;

	server_name redacted;

	add_header X-Tester-Value "tester";

This should output a header value of "tester" for X-Tester-Value. But this value is not output.

In location blocks, add_header does work but only if it is directly within the location block and not within an if block.

Here is a sample configuration inside of the / location.

		set $test "0";
		if ($test = "0") {
			add_header X-Test-Value $test;
		}

		set $hsts 1;
		add_header X-HSTS-Value $hsts;

In this configuration, Nginx outputs "X-HSTS-Value: 1" for the X-HSTS-Value header. The X-Test-Value header is not output. Other variations of if block test (e.g. =, ~, ~*, etc) also do not change the result of the add_header output as the test in the if block is not the issue.

These same header configurations also do not appear to work within the HTTP context. As of present, the only place that add_header does seem to be working correctly is inside of the location context and per the manual, it should be working in all of the locations that I have named here.

Due to differences between HTTP2 and HTTP1 in Nginx, we did try disabling HTTP2 within this server block and it did not produce any difference in results.

Hi

I am developing an service based on nginx which uses it as a reverse proxy - similar to a CDN. My usage involves using the include config method from nginx to include several "listeners" (which in turn include some layer 7 routes - locations). My listeners include a named location which error pages are pointed at via:

error_page 400 =400 @default_error_pages;

location @default_error_pages { ... }

I came across what I believe is a bug this morning wherein the add_header methods used as global header setters in nginx.conf are not issued by requests which are served by my named location - even when I used the "always" flag - e.g. add_header "Some-Header" "Some value" always;. I haven't checked it out in huge detail but it may be that add_header isn't working at all in my named location.

I can work around the issue by using more_set_headers as I have this compiled in.

Happy to check things out if it'd be any use.

Neil