# Feature Request: write error logs when detecting duplicate http headers

**URL:** <https://www.ruby-forum.com/t/feature-request-write-error-logs-when-detecting-duplicate-http-headers/207987>\
**Category:** NGINX\
**Created:** [June 7, 2011, 5:21pm UTC](https://www.ruby-forum.com/t/feature-request-write-error-logs-when-detecting-duplicate-http-headers/207987 "2011-06-07T17:21:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [June 7, 2011, 5:21pm UTC](https://www.ruby-forum.com/t/feature-request-write-error-logs-when-detecting-duplicate-http-headers/207987/1 "2011-06-07T17:21:49Z")

</div>

Hi:

When duplicate http headers occur(e.g., two X-Forwarded-For headers),  
nginx  
will use the first instance silently. This means internal variables like  
$http\_x\_forwarded\_for is not entirely _correct,_ users have to capture  
packets in the network layer to find out the truth. This is a lot of  
inconvenient compared to customize log format.

Also, for headers like “X-Forwarded-For”, attackers can intentionaly  
inject  
serveral spoofed ip addresses.

Although nginx cannot possibly known which one is more important than  
the  
others, it MAY alert user by logging “duplicated headers detected,  
header:value1, value2, … value N”.

Currently, we use nginx-lua module to detect duplicate headers, like:

itable = ngx.req.get\_headers()[“X-Forwarded-For”]  
for k, v in iparis(itable) do  
– process duplicate header  
end

---

<div class="post-metadata">

**Author:** ![SSSSSSS\_SS\_SSS](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/91b2a8/32.png) [@SSSSSSS\_SS\_SSS](https://www.ruby-forum.com/u/SSSSSSS_SS_SSS)\
**Post date:** [June 7, 2011, 6:05pm UTC](https://www.ruby-forum.com/t/feature-request-write-error-logs-when-detecting-duplicate-http-headers/207987/2 "2011-06-07T18:05:47Z")

</div>

Hi,

> Also, for headers like “X-Forwarded-For”, attackers can intentionaly  
> inject serveral spoofed ip addresses.

Of course, that’s why you should _never_ trust the data that comes from  
the  
systems outside of your control.

Best regards,  
Piotr S. \< [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) \>

---

<div class="post-metadata">

**Author:** ![SSSSSSS\_SS\_SSS](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/91b2a8/32.png) [@SSSSSSS\_SS\_SSS](https://www.ruby-forum.com/u/SSSSSSS_SS_SSS)\
**Post date:** [June 8, 2011, 1:03pm UTC](https://www.ruby-forum.com/t/feature-request-write-error-logs-when-detecting-duplicate-http-headers/207987/3 "2011-06-08T13:03:15Z")

</div>

On Tue, Jun 7, 2011 at 4:21 PM, 杨镭 [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Although nginx cannot possibly known which one is more important than the  
> others, it MAY alert user by logging “duplicated headers detected,  
> header:value1, value2, … value N”.

It is not a matter of “knowing which is more important”, the spec is  
clear  
which headers can be repeated and which are invalid, and for this header  
repeating it is invalid. You should make sure you filter any headers you  
are  
using internally like X-Forwarded-For anyway as a security measure…

---

<div class="post-metadata">

**Author:** ![SSSSSSS\_SS\_SSS](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/91b2a8/32.png) [@SSSSSSS\_SS\_SSS](https://www.ruby-forum.com/u/SSSSSSS_SS_SSS)\
**Post date:** [May 30, 2016, 1:06pm UTC](https://www.ruby-forum.com/t/feature-request-write-error-logs-when-detecting-duplicate-http-headers/207987/4 "2016-05-30T13:06:40Z")

</div>

thanks,recently i ran into this problem  
I saw you this post, help me with this problem

Posted at Nginx Forum:

> **[Re: Feature Request: write error logs when detecting duplicate http headers](https://forum.nginx.org/read.php?2,204689,267222#msg-267222)**
>
> Hi: When duplicate http headers occur(e.g., two X-Forwarded-For headers), nginx will use the first instance silently. This means internal variables like $http\_x\_forwarded\_for is not entirely \*correct,\* users have to capture packets in the network...