Handling upstream response 401

Friscia, Michael michael.friscia at yale.edu
Wed Jul 25 13:55:27 UTC 2018

I'm about 98% sure it is returning a 401 but I'm going to do some more research. 

I don't think we did anything too dumb
proxy_cache_valid 200 301 302 404 3m;
proxy_cache_use_stale error timeout updating invalid_header http_500 http_502 http_503 http_504;

This is kind of what is confusing me but also makes me agree that I'm chasing a problem that is different than what I think. Our fix was to purge the pages and everything was fine. So I do know that the upstream response after the security change took place is causing Nginx to serve the previously public/cached version and it always says it served stale. I know that because I have a bunch of custom headers to help debug this type of situation.

Michael Friscia
Office of Communications
Yale School of Medicine
(203) 737-7932 - office
(203) 931-5381 - mobile
http://web.yale.edu <http://web.yale.edu/>

On 7/25/18, 9:44 AM, "nginx on behalf of Maxim Dounin" <nginx-bounces at nginx.org on behalf of mdounin at mdounin.ru> wrote:

    On Wed, Jul 25, 2018 at 01:14:29PM +0000, Friscia, Michael wrote:
    > If the upstream server returns a 401 response I want to make 
    > sure Nginx serves the response. Right now it is serving the 
    > stale version. What happened is that the upstream page was 
    > public but then made secure, so it sends back the 401 redirect 
    > for browser login. Nginx is behaving properly in serving stale 
    > but I want to change how it works just for 401. We do serve 
    > stale for 404 because we don’t see a need to serve a fresh 
    > response every time for content that doesn’t exist.
    Are you sure you are seeng nginx returning a stale response on 401 
    from the upstream server?
    With proxy_cache_use_stale you can configure nginx to return stale 
    responses on 500, 502, 503, 504, 403, 404, and 429 (see 
    https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fnginx.org%2Fr%2Fproxy_cache_use_stale&data=02%7C01%7Cmichael.friscia%40yale.edu%7C68ae0d6a128c4c2bb84808d5f234c28e%7Cdd8cbebb21394df8b4114e3e87abeb5c%7C0%7C0%7C636681230777147527&sdata=Kxl2x76bfhemxInzlnWC601J%2FwIoOTb8C1eYaVS3s%2FA%3D&reserved=0).  It does not, however, 
    return stale responses on 401.
    Either you've did something very strange in your configuration, 
    or you are trying to solve a problem which does not exist.
    Maxim Dounin
    nginx mailing list
    nginx at nginx.org

More information about the nginx mailing list