imported>Jeremy-busk at 18:12, 28 March 2019

2019-03-28T18:12:59Z

New page

# Headers

## Cookies

Format example using curl --cookie "access_token=123"
```
Cookie: access_token=123
```

NGINX LUA Example
```
local access_token = ngx.var.cookie_access_token
ngx.say(access_token)
```

nginx lua raw/get_headers to extract and check header key/value pairs
```
ngx.say(ngx.req.raw_header())
local h = ngx.req.get_headers()
for k, v in pairs(h) do
if k == "numifex_token" then
ngx.say("allow")
ngx.say(k, ": ", v)
end
end
```

## Using underscores in header

In NGINX enable this under server by adding `underscores_in_headers off`;

* https://github.com/ledgetech/lua-resty-http/issues/114
* https://stackoverflow.com/questions/22856136/why-underscores-are-forbidden-in-http-header-names - They are not forbidden. It's CGI legacy
* https://serverfault.com/questions/855720/how-to-prevent-haproxy-from-dropping-http-headers-with-underscores

```
If you do not explicitly set underscores_in_headers on;, nginx will silently drop HTTP headers with underscores (which are perfectly valid according to the HTTP standard). This is done in order to prevent ambiguities when mapping headers to CGI variables, as both dashes and underscores are mapped to underscores during that process.
```

http://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
```
Syntax: underscores_in_headers on | off;
Default:
underscores_in_headers off;
Context: http, server
```

Security

HTTP - Revision history

imported>Jeremy-busk at 18:12, 28 March 2019