X-Accel-Redirect'ed response contains both upstreams Cache-Control headers, not only the last one

[Dmitrii Titarenko]

Config:

server {
    listen       80;
    server_name  localhost;

    location / {
        proxy_pass http://127.0.0.1:8000/;
    }

    location /int/ {
        internal;
        proxy_pass http://127.0.0.1:8888/;
    }
}

Run 2 upstreams, the first one is for an external location with X-Accel-Redirect:

while true; do printf 'HTTP/1.1 200 OK\r\nX-Accel-Redirect:/int/\r\nCache-Control:no-cache,no-store\r\nContent-Length:0\r\n\r\n'; done | nc -vklp 8000

And the second one is for an internal location:

while true; do printf 'HTTP/1.1 200 OK\r\nContent-Type:text/plain\r\nCache-Control:private,max-age=123\r\nContent-Length:5\r\n\r\nHello'; done | nc -vklp 8888

Run curl to the external location:

$ curl -v 127.0.0.1
*   Trying 127.0.0.1:80...
* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)
> GET / HTTP/1.1
> Host: 127.0.0.1
> User-Agent: curl/7.81.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.23.3
< Date: Thu, 23 Feb 2023 18:09:40 GMT
< Content-Type: text/plain
< Content-Length: 5
< Connection: keep-alive
< Cache-Control: no-cache,no-store          <--- (!)
< Cache-Control: private,max-age=123        <--- (!)
< 
* Connection #0 to host localhost left intact

Both Cache-Control headers are present in the response. Expected: only the last one.

Some web frameworks add 'Cache-Control:private' by default (sometimes without provided way to change this behaviour). In that case response contains complete duplicates.

[Maxim Dounin]

The X-Accel-Redirect header redirects nginx to a different URI, with the following headers are copied to the response: "Content-Type", "Set-Cookie", "Content-Disposition", "Cache-Control", "Expires", and "Accept-Ranges". This behaviour makes it possible to effectively return static files from disk while controlling the headers being returned with the file from the script which does redirections. If you don't want nginx to use the headers in the final response, avoid returning them along with the X-Accel-Redirect redirection.

[Dmitrii Titarenko]

Ok, thanks. In my opinion, it is not super obvious behavior (maybe it could be described in the documentation? couldn't find such details), because it seems X-Accel-Redirect is not only for static files. Also the web framework may not support added-by-default header removal from response (this is stupid of course, but that's how old asp.net behaves, can only change header value on smth different or totally disable default adding behavior). Surely can come up with some kind of crutch. As I see it, ideally, to have some separate headers or magic prefix to forward headers in response, smth like X-Accel-Add-Cache-Control.