add_header always in nginx reverse proxy fails in some situation

Question

In following config, when upstream server returns other than HTTP 200 OK response, request to hostnameb.example.org is missing X-custom-server-info header.

hostnamea.example.org response is correct (including the header).

Any idea why or how to fix it?

worker_processes auto;
worker_rlimit_nofile 8192;
pid /opt/bitnami/nginx/tmp/nginx.pid;
events {
    worker_connections 4096;
}
http {
        include /opt/bitnami/nginx/conf/mime.types;

        add_header X-custom-server-info "someinfo" always;

        proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header         Forwarded "";
        proxy_http_version       1.1;
        client_max_body_size     10m;
        client_body_buffer_size  128k;
        proxy_connect_timeout    180;
        proxy_send_timeout       180;
        proxy_read_timeout       180;
        proxy_buffers            32 4k;

        proxy_set_header         Host                $host;
        proxy_set_header         X-Forwarded-Host    $host;
        #proxy_set_header         X-Forwarded-Proto   $scheme;
        #proxy_set_header         X-Forwarded-Port    $server_port;
        proxy_set_header         X-Forwarded-Proto   https;
        proxy_set_header         X-Forwarded-Port    443;

        server_tokens off;
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        server_names_hash_bucket_size 128; # this seems to be required for some vhosts

        default_type application/octet-stream;

        resolver dns-default.openshift-dns.svc.cluster.local valid=300s;


        server {
          listen 8081;
          server_name  hostnamea.example.org;
          set $bff "http://bff.project.svc.cluster.local";

          location / {
            proxy_pass               $bff;
          }
        }

        server {
          listen 8081;
          server_name  hostnameb.example.org;
          set $bff "http://bff.project.svc.cluster.local";


          location / {
            proxy_pass               $bff;
            add_header         Access-Control-Allow-Origin                https://external.example.org always;
            add_header         Access-Control-Allow-Credentials           true always;
          }
        }


        log_format upstreamlog '[$time_local]  "$request" UA:"$http_user_agent"';
        access_log /opt/bitnami/nginx/logs/access.log upstreamlog;
        error_log /opt/bitnami/nginx/logs/error.log;
}

score 0 · Accepted Answer · answered Apr 19 '23 at 22:04

The add_header directive does not inherit from the http block to the server and location blocks when another add_header is present.

You could fix it like that

location / {
  proxy_pass $bff;
  add_header X-custom-server-info "someinfo" always;
}

location / {
  proxy_pass $bff;
  add_header X-custom-server-info "someinfo" always;
  add_header Access-Control-Allow-Origin https://external.example.org always;
  add_header Access-Control-Allow-Credentials true always;
}

restart nginx sudo systemctl restart nginx and now it should work

score 0 · Answer 2 · answered Apr 28 '23 at 21:41

I have added separate file with shared add_header directives and than in each location, I have delaared "include /.../my_file.conf" so it is applied everywhere...

since nginx has unfortunate feature to not merge add_header directives on different levels of config :(

add_header always in nginx reverse proxy fails in some situation

2 Answers2