Hello!

On Sat, Feb 27, 2010 at 09:39:56AM -0800, Brian Pane wrote:

> I think I've found a separate bug in ngx_http_subrequest:
>
> ngx_http_core_module.c, line 2080 (in 0.8.33):
> sr->headers_in = r->headers_in;
>
> This results in a bitwise copy of headers_in from the parent request
> to the subrequest. Inside headers_in is a list:
> typedef struct {
> ngx_list_t headers;
> // ...
> } ngx_http_headers_in_t;
>
> When you do a bitwise copy of an ngx_list_t, you end up with a broken
> list. Specifically, sr->headers_in->list->last in the subrequest
> points to the last node in the r->headers_in.list.part chain in the
> parent request. It should instead point to the last node in the
> subrequest's sr->headers_in.list.part chain.
>
> Thus if any module attempts to add more headers to the subrequest's
> sr->headers_in, they actually will be added to the parent request's
> r->headers_in instead.
>
> I ran into this problem in a module that needs to add extra request
> headers to a proxied subrequest.

It is expected that r->headers_in represent headers got from
client (i.e. inbound headers). It is not expected to be modified
by anything but nginx core when it reads headers from client (and
some modules which sets special variables there, like
r->headers_in.user).

To add headers to proxied [sub]request you have to use means
provided by proxy module, specifically proxy_set_header
configuration directive.

Maxim Dounin

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://nginx.org/mailman/listinfo/nginx-devel