title: nginx - how to block custom headers
body: <p>I have <code>nginx</code> running locally, alongside my local test <code>SOAP server</code>. I am using <code>SoapUI</code> to send soap requests to this server via nginx, eg <code>SoapUI -&gt; Nginx:80 -&gt; SoapSever:9338</code>.</p>
  
  <p>My goal is to strip out non-standard headers, to tighten up security. I want to keep <code>content-type</code>, <code>accept</code>, etc, but  I want to strip headers such as <code>myHeader1</code>, or <code>abc=xyz</code>.</p>
  
  <p>As part of my testing, I am sending custom headers, and I can see them arriving at my server on the far side, so nginx isnt doing any filtering. I tried using <code>ignore_invalid_headers on;</code> in my <code>/etc/nginx/nginx.conf</code> file under <code>http {}</code>, but I think it means something different to what I think it means, as it doesnt strip any headers.</p>
  
  <p>I can see from the docs that you can add headers, or change specific headers, but can I either strip out all non-standard/custom headers, or can I specify a list of headers that I only want to accept?</p>
  
  <p>Thank you.</p>