According to http://nginx.org/en/docs/http/ngx_http_core_module.html#http nginx takes http headers, does some conversions (set a prefix, replace dash with underscore) and provides them as variables:

arbitrary request header field; the last part of a variable name is the field name converted to lower case with dashes replaced by underscores

I want to make use of such a variable like this:

location /whoami {
  add_header Content-Type text/plain;
  set $user "You are ${http_x_ssl_client_s_dn} and authenticating to ${host} and ${http_foo}.";
  return 200 $user;

I can be absolutely sure that the clientauth variable is set, but I receive this response: You are and authenticating to server and .

When I check if the header to variable conversion takes place even the second variable doesn't exist. curl -H foo=bla https://server/whoami returns You are and authenticating to server and .. In this scenario I would have expected ... and bla.

This makes me think that the conversion is disabled, perhaps due to a configuration error or security setting that is on by default. But I didn't find a way to enable it.

I'm using nginx 1.18.0 on Ubuntu 20.04.

  • Does that syntax work with curl -H? Should it be curl -H "foo: bar" ...? Jul 9, 2021 at 8:33
  • @RichardSmith You are absolutely right ...
    – Marged
    Jul 9, 2021 at 8:36

1 Answer 1


Thanks to Richard I found two mistakes:

  • my attempt to diagnose this issue using curl was incorrect because I tried to set the header with -H foo=bla while -H "foo: bla is correct
  • the information I'm searching for isn't available in http headers (at least at this point of the communication)

Instead of editing this question and changing it completely in order to address my remaining question I created a new one: Using clientauth information in location handling

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.