ChatGPT解决这个技术问题 Extra ChatGPT

How to add a response header on nginx when using proxy_pass?

I want to add a custom header for the response received from the server behind nginx.

While add_header works for nginx-processed responses, it does nothing when the proxy_pass is used.

So you pass request to proxy and that proxy set response and on this response you would like to add your custom header before it will be send to user, that's correct?

O
Oliver

add_header works as well with proxy_pass as without. I just today set up a configuration where I've used exactly that directive. I have to admit though that I've struggled as well setting this up without exactly recalling the reason, though.

Right now I have a working configuration and it contains the following (among others):

server {
    server_name  .myserver.com
    location / {
        proxy_pass  http://mybackend;
        add_header  X-Upstream  $upstream_addr;
    }
}

Before nginx 1.7.5 add_header worked only on successful responses, in contrast to the HttpHeadersMoreModule mentioned by Sebastian Goodman in his answer.

Since nginx 1.7.5 you can use the keyword always to include custom headers even in error responses. For example:

add_header X-Upstream $upstream_addr always;

Limitation: You cannot override the server header value using add_header.


Since nginx 1.7.5 you can use "always" to include custom headers in error responses using add_header: add_header X-Upstream $upstream_addr always;
Anyway to have similar functionality w/o exposing the IP/port combination of the proxied server? e.g. X-Upstream: 10.10.10.10 vs X-Upstream: 53c2d28edefdf501ab7c92e02a0c1687 (md5 is probably not helpful in masking the infrastructure, but it conveys the idea).
@zamnuts: Passing the upstream IP and port numbers is just an example of using the add_header directive. You do not have to send them at all.
@Oliver, I'm aware of that, but I was inquiring about an alternate individual/unique upstream identifier other than the IP/port numbers, or an obfuscation thereof. Perhaps my question is out of scope and I should create a new post :)
@zamnuts: I would suggest asking a new question, too :-)
W
Wilt

Hide response header and then add a new custom header value

Adding a header with add_header works fine with proxy pass, but if there is an existing header value in the response it will stack the values.

If you want to set or replace a header value (for example replace the Access-Control-Allow-Origin header to match your client for allowing cross origin resource sharing) then you can do as follows:

# 1. hide the Access-Control-Allow-Origin from the server response
proxy_hide_header Access-Control-Allow-Origin;
# 2. add a new custom header that allows all * origins instead
add_header Access-Control-Allow-Origin *;

So proxy_hide_header combined with add_header gives you the power to set/replace response header values.

Similar answer can be found here on ServerFault

UPDATE:

Note: proxy_set_header is for setting request headers before the request is sent further, not for setting response headers (these configuration attributes for headers can be a bit confusing).


your comment about proxy_set_header there helped me understand the difference between the two calls, thanks :)
S
Sebastian Goodman

There is a module called HttpHeadersMoreModule that gives you more control over headers. It does not come with Nginx and requires additional installation. With it, you can do something like this:

location ... {
  more_set_headers "Server: my_server";
}

That will "set the Server output header to the custom value for any status code and any content type". It will replace headers that are already set or add them if unset.


is it possible to add Secure and HttpOnly flags on a response cookie? The target response cookie only have the cookie name and expire attributes though.
You don't necessarily need a library to be able to change or add response headers and in contrary to the most up-voted answer you can override a header, you simply have to remove it first. Check my answer below for details.
D
Dmitry Minkovsky

As oliver writes:

add_header works as well with proxy_pass as without.

However, as Shane writes, as of Nginx 1.7.5, you must pass always in order to get add_header to work for error responses, like so:

add_header  X-Upstream  $upstream_addr always;

I spent a long time wondering why my headers weren't showing, trying to move them in the server block, location block, ... and here was the reason : nginx doesn't add them on error responses :F Thanks
Me too :) and despite this answer this just happened to me the other day again. Had to review my own answer.
M
Michał Kupisiński

You could try this solution :

In your location block when you use proxy_pass do something like this:

location ... {

  add_header yourHeaderName yourValue;
  proxy_pass xxxx://xxx_my_proxy_addr_xxx;

  # Now use this solution:
  proxy_ignore_headers yourHeaderName // but set by proxy

  # Or if above didn't work maybe this:
  proxy_hide_header yourHeaderName // but set by proxy

}

I'm not sure would it be exactly what you need but try some manipulation of this method and maybe result will fit your problem.

Also you can use this combination:

proxy_hide_header headerSetByProxy;
set $sent_http_header_set_by_proxy yourValue;

I had to use this method as nginx was adding a duplicate header rather than overwriting the exiting one. location / { proxy_pass http://127.0.0.1:8080/; proxy_hide_header "Access-Control-Allow-Origin"; if ($http_origin ~* "^https://(example.com|www.example.com)$") { add_header Access-Control-Allow-Origin "$http_origin"; } }