# Having dot in the header name

**URL:** <https://www.ruby-forum.com/t/having-dot-in-the-header-name/182114>\
**Category:** NGINX\
**Created:** [January 22, 2010, 7:39pm UTC](https://www.ruby-forum.com/t/having-dot-in-the-header-name/182114 "2010-01-22T19:39:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vys](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/4bbf92/32.png) [@vys](https://www.ruby-forum.com/u/vys)\
**Post date:** [January 22, 2010, 7:39pm UTC](https://www.ruby-forum.com/t/having-dot-in-the-header-name/182114/1 "2010-01-22T19:39:10Z")

</div>

Hi,  
I see that nginx as proxy rejects headers with name like “auth.client”  
or  
“auth.token” (with dot in their name) and stops parsing further headers.  
Thus the request to the upstream server doesn’t contain these headers.  
From  
the logs, it says “client sent invalid header line”.

Why is having a dot in the header name considered invalid? I searched  
the  
relevant RFCs (2616 and 822) and they don’t seem to exclude dot. May I  
know  
the reason for nginx to reject headers with dot while other servers like  
Apache httpd parse headers with dot just fine.

Also, in the nginx source I noticed a undocumented directive  
“ignore\_invalid\_headers” which is on by default. It when set to off,  
makes  
nginx passes such headers to the upstream server properly.

Is it safe to use this directive? Are there any side-effects,  
performance  
issues related to using it?

Thanks,

---

<div class="post-metadata">

**Author:** ![vys](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/4bbf92/32.png) [@vys](https://www.ruby-forum.com/u/vys)\
**Post date:** [January 22, 2010, 8:26pm UTC](https://www.ruby-forum.com/t/having-dot-in-the-header-name/182114/2 "2010-01-22T20:26:00Z")

</div>

Hello!

On Sat, Jan 23, 2010 at 12:08:08AM +0530, Vinay Y S wrote:

> Also, in the nginx source I noticed a undocumented directive  
> “ignore\_invalid\_headers” which is on by default. It when set to off, makes  
> nginx passes such headers to the upstream server properly.
> 
> Is it safe to use this directive? Are there any side-effects, performance  
> issues related to using it?

Basically nginx does this because:

1. they aren’t generally used (http itself only uses alphanumeric  
and “-” in headers);

2. they are likely to cause issues, including security ones, with  
translations like CGI does (X-Blah → HTTP\_X\_BLAH, X\_Blah →   
HTTP\_X\_BLAH, X.Blah → HTTP\_X\_BLAH); note that nginx itself uses  
similar translation for $http\_\* variables and AFAIR while passing  
headers to fastcgi backends.

As long as you are ok with the above - it should be mostly ok to  
switch off ignore\_invalid\_headers.

Maxim D.