nginx protocol_error ai_generated true

上游发送了无效标头：“X_Custom_Header: value”，同时从上游读取响应标头，客户端：10.0.0.1，服务器：example.com

upstream sent invalid header: "X_Custom_Header: value" while reading response header from upstream, client: 10.0.0.1, server: example.com

ID: nginx/upstream-sent-invalid-header-underscore

其他格式: JSON · Markdown 中文 · English
95%修复率
88%置信度
1证据数
2024-06-05首次发现

版本兼容性

版本状态引入弃用备注
nginx/1.18.0 active — — —
nginx/1.20.0 active — — —
nginx/1.24.0 active — — —
nginx/1.26.0 active — — —

根因分析

Nginx 默认丢弃名称中包含下划线的 HTTP 标头，根据 RFC 7230 将其视为无效，因为可能与 CGI/遗留系统存在不一致。

English

Nginx by default discards HTTP headers containing underscores in the name, treating them as invalid per RFC 7230 due to potential inconsistencies with CGI/legacy systems.

generic

官方文档

https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers

解决方案

  1. 在 http、server 或 location 块中启用 underscores_in_headers：`underscores_in_headers on;`
  2. 如果担心安全问题，请在上游应用程序中将标头重命名为使用连字符（例如 X-Custom-Header 而不是 X_Custom_Header），并更新所有客户端。
  3. 使用 proxy_set_header 将传入标头映射到清理后的版本：`proxy_set_header X-Custom-Header $http_x_custom_header;`（需要 underscores_in_headers on 或更改标头名称）。

无效尝试

常见但无效的做法:

  1. 40% 失败

    While this works, it requires application changes that may not be feasible in all deployments; nginx can be configured to accept underscores.

  2. 70% 失败

    ignore_invalid_headers controls general header validity, but underscore handling is controlled by the underscores_in_headers directive specifically.

  3. 90% 失败

    The default behavior is intentional and unchanged across versions; a config change is required.