Caddy: v2: header_down removes headers added by caddy too

Created on 9 May 2020 · 3Comments · Source: caddyserver/caddy

I'm using an import for my security headers. They are in a snippets folder located where the Caddyfile is.

snippets/sec-headers

header {
  X-Xss-Protection "1; mode=block"
  X-Content-Type-Options "nosniff"
  X-Robots-Tag "none"
  X-Permitted-Cross-Domain-Policies "none"
  X-Download-Options "noopen"
  Referrer-Policy "strict-origin-when-cross-origin"
  Cache-Control "public, max-age=15, must-revalidate"
  Server "SomeServer"
  X-Frame-Options "SAMEORIGIN"
  Content-Security-Policy "upgrade-insecure-requests"
}

Caddyfile

example.com {

  import snippets/sec-headers

  reverse_proxy http://backend.local {
      header_down -Server
  }

}

The backend.local service sends it's own Server header which I want to remove, so that there is only the Server header from the imported snippets/sec-headers file. But if I use the header_down directive like this, no Server header reaches the client and if I remove the directive, the client receives two headers, one with the value from the backend and one from the sec-headers file. In Caddy v1 this worked like a charm with the header_downstream directive.

I know that I can overwrite the headers in the header_down directive like

reverse_proxy http://backend.local {
  header_down Server "SomeServer"
}

which works, but that means that I have to set all headers for every reverse proxy I use (which are many) separately. This would be really impractical if I'd like to change or add something in the future.

So what can I do to fix it, or is this a bug?

(I'm using the latest caddy docker image with only the standard plugins loaded.)

bug

Source