Custom Query (2311 matches)

Hi

I am developing an service based on nginx which uses it as a reverse proxy - similar to a CDN. My usage involves using the include config method from nginx to include several "listeners" (which in turn include some layer 7 routes - locations). My listeners include a named location which error pages are pointed at via:

error_page 400 =400 @default_error_pages;

location @default_error_pages { ... }

I came across what I believe is a bug this morning wherein the add_header methods used as global header setters in nginx.conf are not issued by requests which are served by my named location - even when I used the "always" flag - e.g. add_header "Some-Header" "Some value" always;. I haven't checked it out in huge detail but it may be that add_header isn't working at all in my named location.

I can work around the issue by using more_set_headers as I have this compiled in.

Happy to check things out if it'd be any use.

Neil

My nginx config is basically the following:

http {
  #whole bunch of other options left out
  add_header "test1" "value1";
  include sites-enabled/*.conf;
}

Where a file in sites-enabled looks like this:

server {
  listen 80;
  server_name example.com;
  #root, access_log etc left out
  add_header "test2" "value2";
}

Only the test2 header shows up, while i expect both headers to show up in the output.

Hi team,

there may be insufficient verification of the correctness of the header name or full header instruction.

In my case, the mistape was sending the wrong header name. Example: add_header Permissions-Policy" "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), window-placement=(self), vertical-scroll=(self)";

The result: HTTP2 stream breaks for any clients. HTTP1.1 breaks for iPhones and may be iMacs

Best regards, Pavlo.