{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/853","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/853/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/853/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/853/events","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/853","id":64775908,"number":853,"title":"nginx: intentionally removed response headers are added back in","user":{"login":"eyz","id":4591181,"avatar_url":"https://avatars.githubusercontent.com/u/4591181?v=3","gravatar_id":"","url":"https://api.github.com/users/eyz","html_url":"https://github.com/eyz","followers_url":"https://api.github.com/users/eyz/followers","following_url":"https://api.github.com/users/eyz/following{/other_user}","gists_url":"https://api.github.com/users/eyz/gists{/gist_id}","starred_url":"https://api.github.com/users/eyz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eyz/subscriptions","organizations_url":"https://api.github.com/users/eyz/orgs","repos_url":"https://api.github.com/users/eyz/repos","events_url":"https://api.github.com/users/eyz/events{/privacy}","received_events_url":"https://api.github.com/users/eyz/received_events","type":"User","site_admin":false},"labels":[{"id":274024288,"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/labels/TBF%20by%20libmodsec","name":"TBF by libmodsec","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":{"login":"zimmerle","id":428268,"avatar_url":"https://avatars.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"assignees":[{"login":"zimmerle","id":428268,"avatar_url":"https://avatars.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false}],"milestone":null,"comments":10,"created_at":"2015-03-27T14:40:32Z","updated_at":"2016-12-26T13:58:46Z","closed_at":null,"body":"This is regarding the nginx version of ModSecurity 2.9.0\n\nI am removing headers such as \"Server\" and \"X-Powered-By\" in an ngx lua script within the \"server\" block.\n\nWhen I have ModSecurity enabled in the context of the \"server\" block, the removed headers are added back in, but with empty values. Such as -\n\nServer: [EMPTY]\nX-Powered-By: [EMPTY]\n^ field values are blank, but fields are added back in\n\nHowever, when I enable ModSecurity in the \"location\" block context, the headers are left removed as intended -- not added back in -- working correctly.\n\nI had tried activating ModSecurity in the \"server\" context to workaround behavior that I've reported in #854, which caused me to find the behavior in this issue.  \n\nnginx version: nginx/1.6.2 (on x86_64)\nbuilt by gcc 4.8.2 20140120 (Red Hat 4.8.2-16) (GCC) \nTLS SNI support enabled\nconfigure arguments: --with-ld-opt=-Wl,-rpath,/usr/local/lib --with-cc-opt='-DNGX_LUA_USE_ASSERT -DNGX_LUA_ABORT_AT_PANIC' --add-module=/root/lua-nginx-module-0.9.16rc1 --add-module=/root/ngx_devel_kit-0.2.19 --add-module=/root/modsecurity-2.9.0/nginx/modsecurity --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/var/run/nginx.pid --lock-path=/var/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_spdy_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_image_filter_module --with-http_geoip_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_stub_status_module --with-http_perl_module --with-mail --with-mail_ssl_module --with-pcre --with-google_perftools_module --with-debug --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic' --with-ld-opt=-Wl,-E\n\nI have seen some commits regarding adding response headers back in within the nginx refactoring branch, and wonder if this behavior could be a side effect of anything in those areas.. ?\n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/269213707","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/853#issuecomment-269213707","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/853","id":269213707,"user":{"login":"zimmerle","id":428268,"avatar_url":"https://avatars.githubusercontent.com/u/428268?v=3","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"created_at":"2016-12-26T13:58:46Z","updated_at":"2016-12-26T13:58:46Z","body":"Hi @Airis777,\r\n\r\nWhy not the ModSecurity-nginx connector ?\r\n\r\n"}}
{"actor":{"display_login":"zimmerle"}}