Bug 64646 - Header "set" does not replace content-disposition header passed from content handler
Summary: Header "set" does not replace content-disposition header passed from content ...
Status: RESOLVED WORKSFORME
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_headers (show other bugs)
Version: 2.4.43
Hardware: PC Linux
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-08-05 07:00 UTC by Raffaele Sandrini
Modified: 2020-08-08 11:11 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Raffaele Sandrini 2020-08-05 07:00:41 UTC
In a setup where an incoming request is handled by PHP-FPM through "SetHandler "proxy:fcgi:...", the handling PHP script is setting the response header:

content-disposition: attachment; filename="foo.pdf"

The directive:

Header set "content-disposition" "baz"

set in a .htaccess file

will result in headers:

HTTP/1.1 200 OK
Server: Apache
content-disposition: attachment; filename="foo.pdf"
content-disposition: baz
[...]

Which is unexpected according to what is specified in the documentation of mod_header.

"set
The response header is set, replacing any previous header with this name. The value may be a format string."
Comment 1 Christophe JAILLET 2020-08-05 20:50:19 UTC
Hi,

In the doc, a few lines above what you mention, you have a warning which explains that the 'onsucess" or 'always' "conditions" may give different results depending of your use case. One of this difference is when:

  - You're modifying or removing a header generated by a CGI script or by mod_proxy_fcgi, in which case the CGI scripts' headers are in the table corresponding to always and not in the default table.

This looks like your use case.

Does:
   Header always set "content-disposition" "baz"
helps?
Comment 2 Raffaele Sandrini 2020-08-08 11:11:52 UTC
You are right. Using "always" solved the issue. You are also right that it is documented in the same segment.
However, this whole thing with the different header tables is convoluted and one need some brain power to understand the documentation segment ;-).