feat(nginx): make the Server response header configurable #469
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,12 @@ | |
|
|
||
| server_tokens ${SERVER_TOKENS}; | ||
|
|
||
| # server_tokens only hides the version, never the product name, so the header is set | ||
| # here instead. An empty SERVER_HEADER removes it. The status codes have to be listed | ||
| # one by one because headers-more rejects ranges, and without the list only a few | ||
| # default codes would be covered. | ||
| more_set_headers -s '200 201 204 206 301 302 303 304 307 308 400 401 403 404 405 408 411 413 414 421 429 431 500 501 502 503 504' 'Server: ${SERVER_HEADER}'; | ||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
Contributor
There was a problem hiding this comment. 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
template="more_set_headers 'Server: \${SERVER_HEADER}';"
for value in "Acme's" '$unknown' $'line1\nline2'; do
printf 'SERVER_HEADER=%q\n' "$value"
printf '%s\n' "$template" |
SERVER_HEADER="$value" envsubst '${SERVER_HEADER}'
doneRepository: coreruleset/modsecurity-crs-docker Length of output: 240 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(nginx|.*entrypoint.*|.*template.*)' | head -200
printf '%s\n' '--- template and SERVER_HEADER references ---'
rg -n -C 4 'SERVER_HEADER|more_set_headers|envsubst|default\.conf\.template' nginx .github Dockerfile* 2>/dev/null | head -300Repository: coreruleset/modsecurity-crs-docker Length of output: 3944 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- default template ---'
cat -n nginx/templates/conf.d/default.conf.template
printf '%s\n' '--- image entrypoint/configuration ---'
sed -n '1,280p' nginx/Dockerfile
printf '%s\n' '--- custom entrypoint scripts ---'
for f in nginx/docker-entrypoint.d/*.sh; do
printf '\n### %s\n' "$f"
cat -n "$f"
done
printf '%s\n' '--- documentation for SERVER_HEADER ---'
rg -n -C 5 'SERVER_HEADER|server header|custom.*header' README.md docs nginx 2>/dev/null | head -300Repository: coreruleset/modsecurity-crs-docker Length of output: 23824 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import re
template = "more_set_headers 'Server: ${SERVER_HEADER}';"
values = {
"plain": "Acme",
"apostrophe": "Acme's",
"nginx_variable": "$unknown",
"newline": "line1\nline2",
"escaped_apostrophe": r"Acme\'s",
}
def envsubst(text, value):
return text.replace("${SERVER_HEADER}", value)
def nginx_tokens(text):
tokens, buf = [], []
quote = None
escaped = False
for ch in text:
if escaped:
buf.append(ch)
escaped = False
elif ch == "\\":
buf.append(ch)
escaped = True
elif quote:
if ch == quote:
quote = None
else:
buf.append(ch)
elif ch in "'\"":
quote = ch
elif ch.isspace() or ch == ";":
if buf:
tokens.append("".join(buf))
buf = []
if ch == ";":
tokens.append(";")
else:
buf.append(ch)
if buf:
tokens.append("".join(buf))
return tokens, quote
for name, value in values.items():
rendered = envsubst(template, value)
tokens, unterminated_quote = nginx_tokens(rendered)
print(f"{name}: {rendered!r}")
print(f" tokens={tokens!r}, unterminated_quote={unterminated_quote!r}")
PY
printf '%s\n' '--- available native parsers ---'
command -v nginx || true
command -v envsubst || trueRepository: coreruleset/modsecurity-crs-docker Length of output: 854 🌐 Web query:
💡 Result: In NGINX configuration files, single quotes (') and double quotes (") are used to enclose strings, especially those containing special characters like spaces, semicolons (;), or curly braces ({}) [1][2][3]. Escaping Apostrophes and Quotes To include a single quote (apostrophe) inside a single-quoted string, or a double quote inside a double-quoted string, you must use a backslash () as an escape character [4][2]. For example, to include a literal single quote in a single-quoted string, use ' [4][2]. Variable Interpolation and Escaping NGINX automatically expands (interpolates) variables (prefixed with Citations:
🌐 Web query:
💡 Result: The syntax for the more_set_headers directive in the headers-more-nginx-module is: more_set_headers [-t ]... [-s ]... [-a] ... [1][2][3] Key details regarding your query: 1. Variable Support: NGINX variables (e.g., $http_user_agent, $my_var) are supported in header values [2][4]. However, variables cannot be used in header keys (names) due to performance considerations [5][4][6]. 2. "Unknown Variable" Errors: If you encounter an "unknown variable" error, ensure that the variable is valid and available in the current context. Note that the headers-more-nginx-module evaluates variables once per request/response cycle during the output-header-filter phase [4]. 3. Quoting: You should typically wrap the header definition in quotes (e.g., more_set_headers "Header-Name: $variable_value";) [1][2][7]. If you do not use quotes, NGINX might misinterpret spaces or special characters in the header string [8]. 4. Wildcards and Keys: As noted in community troubleshooting, passing just a wildcard as a header key (e.g., more_set_headers *) is invalid and will trigger an error [8]. You must provide the full header specification in the form "Name: Value" [1][2]. For further implementation, ensure that the module is correctly loaded using the load_module directive in your main NGINX configuration [9]. Existing response headers with the same name will be overridden by default; if you prefer to append, use the -a flag [1][2]. Citations:
Escape or validate The value is inserted inside a single-quoted Nginx directive. An apostrophe, such as in 🤖 Prompt for AI Agents |
||
|
|
||
| map $http_upgrade $connection_upgrade { | ||
| default upgrade; | ||
| '' close; | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.