Header "Expires" and "Cache-Control" is not sent for random requests when using "expires" directive

[wkuranowski@…]

There is a problem with missing "Expires" and "Cache-Control" headers from my upstream "nfs_files". It's a rare situation and it looks like "expires" directive is not executed for some reason. I am not able to reproduce it manually, but when I grep nginx cache directory on a production server I can easily find files without those headers. Accessing those files with a browser also confirms that headers are missing. But header "Access-Control-Allow-Origin" is always present.

It happens for all kind of filetypes - css/js/jpg/png, gzipped/not gzipped etc.

I have configuration like below. I hope that I included all relevant config options. I am using nginx 1.8.0 but it happens also on 1.9.4. Error logs are empty.

http {
   sendfile on;

   proxy_cache_lock    on;
   proxy_cache_path    /mnt/nginx-cache levels=1:2 keys_zone=IMG:256m inactive=3h max_size=8g use_temp_path=off;
   proxy_cache_use_stale    error timeout invalid_header updating http_500 http_502 http_503 http_504;

   map $uri $expires {
      default 1d;
      ~^/admin/config/ 10s;
      ~*\.(?:js|css)$ 5m;
   }

   upstream nfs_files {
      server unix:/var/run/nginx_nfs_files.socket;
   }

   server {
      listen 80 default_server;

      location / {
         proxy_cache   IMG;
         #expires header from nfs_files upstream has a higher priority
         proxy_cache_valid   200 1d;
         proxy_pass    http://nfs_files;
      }
   }

   server {
      listen  unix:/var/run/nginx_nfs_files.socket;

      gzip       on;
      gzip_types application/javascript text/css text/xml text/plain application/json;
      gzip_vary  on;

      location / {
         add_header Access-Control-Allow-Origin *;

         #doesn't work for random requests
         expires $expires;

         root    /mnt/nfs/data;
      }
   }
}

[Maxim Dounin]

Please provide ​debug log of a request without Expires header added to the response.

[wkuranowski@…]

I have a new hint - I am unable to find missing Expires header when using "expires 12h" instead of "expires $expires". It looks like using variable triggers this issue.

I need a few hours of our production traffic to find request with missing Expires. For now I will try to enable debug log only for a unix socket communication with:

events {
    debug_connection unix:;
}

I hope this will give us some useful data.

[wkuranowski@…]

Missing Expires header

[wkuranowski@…]

Correct Expires header

[wkuranowski@…]

I have captured responses without Expires header. Let me know if you need more information.

[wkuranowski@…]

Missing Gzip and Expires

[wkuranowski@…]

I have found another interesting example. There is no Expires header and also gzip filter was not executed for a text/css file with "Accept-Encoding: gzip" header set.

File attached.

[wkuranowski@…]

Ok, I think that missing gzip filter is because of "Via" header...

[wkuranowski@…]

I also see that a request in file "missing_expires.txt" has "cache-control: max-age=0". But this is a request header and should be irrelevant. In "missing_gzip_missing_expires.txt" file there is no "cache-control" and Expires is missing too.

[Maxim Dounin]

Please try the following patch (problem found by Roman Arutyunyan):

diff --git a/src/core/ngx_parse.c b/src/core/ngx_parse.c
--- a/src/core/ngx_parse.c
+++ b/src/core/ngx_parse.c
@@ -188,7 +188,7 @@ ngx_parse_time(ngx_str_t *line, ngx_uint
             break;
 
         case 'm':
-            if (*p == 's') {
+            if (p < last && *p == 's') {
                 if (is_sec || step >= st_msec) {
                     return NGX_ERROR;
                 }

[wkuranowski@…]

I can confirm that your patch solves this issue. I am also unable to reproduce this when I change 5m to 300s in expires map.

Thanks!

[Maxim Dounin <mdounin@…>]

In 6287:4ccb37b04454/nginx:

Fixed ngx_parse_time() out of bounds access (ticket #821).

The code failed to ensure that "s" is within the buffer passed for
parsing when checking for "ms", and this resulted in unexpected errors when
parsing non-null-terminated strings with trailing "m". The bug manifested
itself when the expires directive was used with variables.

Found by Roman Arutyunyan.

[Maxim Dounin]

Fix committed, thanks for reporting the problem and testing the patch.

[Maxim Dounin <mdounin@…>]

In 6344:a8ecb0a2193f/nginx:

Fixed ngx_parse_time() out of bounds access (ticket #821).

The code failed to ensure that "s" is within the buffer passed for
parsing when checking for "ms", and this resulted in unexpected errors when
parsing non-null-terminated strings with trailing "m". The bug manifested
itself when the expires directive was used with variables.

Found by Roman Arutyunyan.