Handling upstream response 401

[Friscia, Michael]

I'm about 98% sure it is returning a 401 but I'm going to do some more research. 

I don't think we did anything too dumb
proxy_cache_valid 200 301 302 404 3m;
proxy_cache_use_stale error timeout updating invalid_header http_500 http_502 http_503 http_504;

This is kind of what is confusing me but also makes me agree that I'm chasing a problem that is different than what I think. Our fix was to purge the pages and everything was fine. So I do know that the upstream response after the security change took place is causing Nginx to serve the previously public/cached version and it always says it served stale. I know that because I have a bunch of custom headers to help debug this type of situation.

___________________________________________
Michael Friscia
Office of Communications
Yale School of Medicine
(203) 737-7932 - office
(203) 931-5381 - mobile
http://web.yale.edu <http://web.yale.edu/>
 

On 7/25/18, 9:44 AM, "nginx on behalf of Maxim Dounin" <nginx-bounces at nginx.org on behalf of mdounin at mdounin.ru> wrote:

    Hello!
    
    On Wed, Jul 25, 2018 at 01:14:29PM +0000, Friscia, Michael wrote:
    
    > If the upstream server returns a 401 response I want to make 
    > sure Nginx serves the response. Right now it is serving the 
    > stale version. What happened is that the upstream page was 
    > public but then made secure, so it sends back the 401 redirect 
    > for browser login. Nginx is behaving properly in serving stale 
    > but I want to change how it works just for 401. We do serve 
    > stale for 404 because we don’t see a need to serve a fresh 
    > response every time for content that doesn’t exist.
    
    Are you sure you are seeng nginx returning a stale response on 401 
    from the upstream server?
    
    With proxy_cache_use_stale you can configure nginx to return stale 
    responses on 500, 502, 503, 504, 403, 404, and 429 (see 
    https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fnginx.org%2Fr%2Fproxy_cache_use_stale&data=02%7C01%7Cmichael.friscia%40yale.edu%7C68ae0d6a128c4c2bb84808d5f234c28e%7Cdd8cbebb21394df8b4114e3e87abeb5c%7C0%7C0%7C636681230777147527&sdata=Kxl2x76bfhemxInzlnWC601J%2FwIoOTb8C1eYaVS3s%2FA%3D&reserved=0).  It does not, however, 
    return stale responses on 401.
    
    Either you've did something very strange in your configuration, 
    or you are trying to solve a problem which does not exist.
    
    -- 
    Maxim Dounin
    https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmdounin.ru%2F&data=02%7C01%7Cmichael.friscia%40yale.edu%7C68ae0d6a128c4c2bb84808d5f234c28e%7Cdd8cbebb21394df8b4114e3e87abeb5c%7C0%7C0%7C636681230777147527&sdata=GkWklGERT05XBbBapSY0h8awKUd6TVRQqnmMzWczKhk%3D&reserved=0
    _______________________________________________
    nginx mailing list
    nginx at nginx.org
    https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmailman.nginx.org%2Fmailman%2Flistinfo%2Fnginx&data=02%7C01%7Cmichael.friscia%40yale.edu%7C68ae0d6a128c4c2bb84808d5f234c28e%7Cdd8cbebb21394df8b4114e3e87abeb5c%7C0%7C0%7C636681230777147527&sdata=p0MK9pgGrdc20wVxNxTXigE5DE%2FY%2B7tqFe2YKdXAjbQ%3D&reserved=0