1

I have the following vcl_deliver subroutine:

sub vcl_deliver {

 # Remove some HTTP-headers:
 unset resp.http.Server;
 unset resp.http.X-Varnish;
 unset resp.http.Via;
 unset resp.http.X-Cacheable;
 unset resp.http.Age;

 return (deliver);
}

Now the strange thing is that every other HTTP header get's removed except the Server header (I've checked with curl and with Google Chrome). When I debug with varnishlog -g raw, I get the following information:

202443 RespProtocol   c HTTP/1.1
202443 RespStatus     c 200
202443 RespReason     c OK
202443 RespHeader     c Server: nginx
202443 RespHeader     c Content-Type: text/html; charset=UTF-8
202443 RespHeader     c Vary: Accept-Encoding
202443 RespHeader     c Cache-Control: no-cache, private
202443 RespHeader     c Date: Sun, 12 Aug 2018 14:19:11 GMT
202443 RespHeader     c X-Frame-Options: SAMEORIGIN
202443 RespHeader     c X-XSS-Protection: 1; mode=block
202443 RespHeader     c X-Content-Type-Options: nosniff
202443 RespHeader     c Content-Encoding: gzip
202443 RespHeader     c X-Varnish: 202443 168601
202443 RespHeader     c Age: 69910
202443 RespHeader     c Via: 1.1 varnish (Varnish/5.0)
202443 VCL_call       c DELIVER                                                                                                            [7/171]
202443 RespUnset      c Server: nginx
202443 RespUnset      c X-Varnish: 202443 168601
202443 RespUnset      c Via: 1.1 varnish (Varnish/5.0)
202443 RespUnset      c Age: 69910
202443 VCL_return     c deliver
202443 Timestamp      c Process: 1534153462.090447 0.000147 0.000147
202443 RespUnset      c Content-Encoding: gzip
202443 RespHeader     c Accept-Ranges: bytes
202443 Debug          c "RES_MODE 40"
202443 RespHeader     c Connection: close
202443 Gzip           c U D - 0 0 0 0 0
202443 Timestamp      c Resp: 1534153462.090535 0.000235 0.000088
202443 ReqAcct        c 229 0 229 302 0 302
202443 End            c
202442 SessClose      c REQ_CLOSE 0.000
202442 End            c

As we can seee (RespUnset Server: nginx) Varnish is trying to remove the HTTP Server header - but why does it still appear when I debug with curl or Google Chrome?

2

You must be using Varnish with nginx "sandwich" for SSL termination:

nginx (SSL) -> Varnish -> nginx

So naturally, after removing Serverheader in Varnish, the nginx (SSL) still sends a header of its own.

The solution is to remove the Server header in nginx as well, e.g. using headers-more nginx module:

more_clear_headers Server;
  • Very good, MOLODEZ! – chevallier Aug 13 '18 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.