Nginx as a reverse proxy will not pass headers that contain a period.

[Cameron Ortiz]

When Nginx is configured as a reverse proxy it will not pass any http headers that have a name containing a period.

I was able to reproduce this issue by creating a very basic reverse proxy configuration in nginx to another server running apache:

[root@cloud-server-01 ~]# cat /etc/nginx/conf.d/headertest.conf
server {
	listen 166.78.134.122:80;
	location / {
		proxy_pass http://10.183.5.144;
	}
}

On the Apache server I created a small php script that would show the request headers:

[root@cloud-server-02 ~]# cat /var/www/html/index.php 

<?php
$headers = apache_request_headers();

foreach ($headers as $header => $value) {
    echo "$header: $value <br />\n";
}
?>

When I pass a header that has a period to the NginX server it does not get forwarded to the Apache server:

[ccortiz@ninja ~]$ curl -H 'test: this is a test' 166.78.134.122

Host: 10.183.5.144 <br />
Connection: close <br />
User-Agent: curl/7.32.0 <br />
Accept: */* <br />
test: this is a test <br />
Via: 1.1 537618-AUS2WWSG01.secops.rackspace.com 0A014411 <br />

[ccortiz@ninja ~]$ curl -H 'tes.t: this is a test' 166.78.134.122

Host: 10.183.5.144 <br />
Connection: close <br />
User-Agent: curl/7.32.0 <br />
Accept: */* <br />
Via: 1.1 537618-AUS2WWSG01.secops.rackspace.com 0A014411 <br />

I have attached a tcpdump that was ran on the nginx server. You can view this in wireshark to see that the header is coming into nginx but is not going out to the apache server.

[Valentin V. Bartenev]

​http://nginx.org/r/ignore_invalid_headers

[efge@…]

(I'm not the original submitter)

I'm asking for this to be reopened because the default behavior actually ignores headers which are valid. A period is a valid header field. Per RFC 2730 (HTTP 1.1 Message Syntax and Routing) (​http://tools.ietf.org/html/rfc7230) we have:

• 3.2: header-field = field-name ":" OWS field-value OWS
• 3.2: field-name = token
• 3.2.6: token = 1*tchar
• 3.2.6: tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_" / "(backquote)" / "|" / "~" / DIGIT / ALPHA

[Maxim Dounin]

By default nginx ignores headers it considers invalid as per rules documented. The rules are composed based on what various standards define, what real browsers use, and the fact that other characters may be unsafe with various commonly used software, including nginx itself. Whether or not these headers match a grammar of a particular RFC is mostly irrelevant. The ignore_invalid_headers directive allows to control whether only headers matching the rules documented will be handled and passed to upstream servers by nginx, or any header will do.

There are no plans to change the default behaviour. If you disagree with the directive name - you may suggest renaming it. If you want to introduce some additional behaviour, e.g., to pass headers with dots, you may introduce an additional directive to do this, similar to underscores_in_headers. In either case please make it clear why the suggested change is needed. See ​Contributing Changes for some additional details.

[Maxim Dounin]

See also #2184.