4 ms·
A common pit I fell into is the "inheritance" of add_header. If you use a single add_header at a lower level all add_headers at the higher levels are ignored fo
by weinzierl 6y ago
A common pit I fell into is the "inheritance" of add_header. If you use a single add_header at a lower level all add_headers at the higher levels are ignored for that server or location.
As some headers have security implications this is an easy way to shoot yourself in the foot.
Another security related point is the suppression of the server version. While nginx can omit the version number out-of-the-box, you unfortunately need an extension to remove the header completely.
- sneak 6y agoThat (the add_header thing) seems like a bug that should be fixed.
- megous 6y agoIt's intentional, and probably common to all "list" manipulating directives. It's the same behavior you get with fastcgi_param and similar, for example.
- HajiraSifre 6y agoYou just have to use ngx_headers_more instead of the built-in headers module. That add_header would get fixed (as a sibling comment states it should) is unlikely as it is intended to work that way: > There could be several add_header directives. These directives are inherited from the previous configuration level if and only if there are no add_header directives defined on the current level. It really is too bad that the functionality provided by ngx_headers_more isn't available out of the box, since it makes it a pain to use nginx on distributions that don't package it.
- weinzierl 6y agoIn addition to that, the ngx_headers_more module also solves the second issue I mentioned. It can be used to remove the Server header completely.
- 2ion 6y agoIt should also be noted that setting the server token as part of nginx core is part of their commercial offering [1]. [1] http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens http://nginx.org/en/docs/http/ngx_http_core_module.html#serv...
- secondcoming 6y agoI think Apache forces some sort of Server header too.
- Symbiote 6y agoThe minimum is Server: Apache with the ServerSignature and ServerTokens configuration parameters.