Hello!

On Sun, Feb 02, 2020 at 11:09:14PM -0800, Frank Liu wrote:

> When I send a request with too longer header value to nginx 1.16.1, I get
> 400 Bad Request response code and default nginx error page.
> If I create a custom error page:
> error_page 494 /my4xx.html;
> now I can see my error page but the http response code becomes 494. Is that
> a bug?
> Shall I see 400 instead?

Yes. And this is what happens with 495, 496, and 497. The
following patch should fix this:

# HG changeset patch
# User Maxim Dounin <mdounin@mdounin.ru>
# Date 1580748298 -10800
# Mon Feb 03 19:44:58 2020 +0300
# Node ID 7b48f7d056af4ce5a681b97f9f31702adb1f87f8
# Parent b8a512c6466c3b2f77876edf14061c5d97e6159f
Added default overwrite in error_page 494.

We used to have default error_page overwrite for 495, 496, and 497, so
a configuration like

error_page 495 /error;

will result in error 400, much like without any error_page configured.

The 494 status code was introduced later (in 3848:de59ad6bf557, nginx 0.9.4),
and relevant changes to ngx_http_core_error_page() were missed, resulting
in inconsistent behaviour of "error_page 494" - with error_page configured
it results in 494 being returned instead of 400.

Reported by Frank Liu,
http://mailman.nginx.org/pipermail/nginx/2020-February/058957.html.

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -4689,6 +4689,7 @@ ngx_http_core_error_page(ngx_conf_t *cf,
case NGX_HTTP_TO_HTTPS:
case NGX_HTTPS_CERT_ERROR:
case NGX_HTTPS_NO_CERT:
+ case NGX_HTTP_REQUEST_HEADER_TOO_LARGE:
err->overwrite = NGX_HTTP_BAD_REQUEST;
}
}


--
Maxim Dounin
http://mdounin.ru/
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx